Analysis
-
max time kernel
115s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-06-2021 12:05
Static task
static1
Behavioral task
behavioral1
Sample
Scan docs.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Scan docs.exe
Resource
win10v20210408
General
-
Target
Scan docs.exe
-
Size
926KB
-
MD5
94159f5873c12cd7ee9b2ab1a0123afc
-
SHA1
16bb42d7b6ec5536c06c4d7e424633940f61263d
-
SHA256
aa1726ec4e7bc607566c3c181498b479506c40449f69319a7bf0981f4e052bfe
-
SHA512
e815a803e83c7b1e8584a043286503842c8c79b4be7193b92950a0df637be661b53de4bf473278b5c038097af9fd2213908a5b90527d232205d1e6eb226d11b5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.atlmexco.com - Port:
587 - Username:
maksat@atlmexco.com - Password:
Ma1301
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3620-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/3620-128-0x00000000004375DE-mapping.dmp family_agenttesla behavioral2/memory/3620-134-0x0000000004F00000-0x00000000053FE000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Scan docs.exedescription pid process target process PID 1400 set thread context of 3620 1400 Scan docs.exe Scan docs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Scan docs.exeScan docs.exepid process 1400 Scan docs.exe 1400 Scan docs.exe 1400 Scan docs.exe 1400 Scan docs.exe 1400 Scan docs.exe 1400 Scan docs.exe 3620 Scan docs.exe 3620 Scan docs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan docs.exeScan docs.exedescription pid process Token: SeDebugPrivilege 1400 Scan docs.exe Token: SeDebugPrivilege 3620 Scan docs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Scan docs.exedescription pid process target process PID 1400 wrote to memory of 2256 1400 Scan docs.exe schtasks.exe PID 1400 wrote to memory of 2256 1400 Scan docs.exe schtasks.exe PID 1400 wrote to memory of 2256 1400 Scan docs.exe schtasks.exe PID 1400 wrote to memory of 1816 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 1816 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 1816 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 3620 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 3620 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 3620 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 3620 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 3620 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 3620 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 3620 1400 Scan docs.exe Scan docs.exe PID 1400 wrote to memory of 3620 1400 Scan docs.exe Scan docs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan docs.exe"C:\Users\Admin\AppData\Local\Temp\Scan docs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DfvHLzAuHD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8212.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Scan docs.exe"C:\Users\Admin\AppData\Local\Temp\Scan docs.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Scan docs.exe"C:\Users\Admin\AppData\Local\Temp\Scan docs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scan docs.exe.logMD5
5b50852bf977f644bcd5997b7b5883c1
SHA18b53694b796620422b366dc5b8dbb3ce3060473c
SHA256667bc8c8d53eddf6355877344b669db4fb9762e6320afc7316c3786213a254a9
SHA5127e794fa7de5eca585000ef840ca821f36205d25b389747339d8b8d58b1ef3cd16306e62288f86027cbe6a76eeccc9dc7634a11c94ba551f3ce42ee874fac712d
-
C:\Users\Admin\AppData\Local\Temp\tmp8212.tmpMD5
aeb3b18ca1226f9bfa86002b28b6eede
SHA1dc64dbb3000783766e00679552311a62d9823a1d
SHA2563dbc8ab2993df9de1cd723fa3dcbd8dde9f40f7a9eb9407c56d48a3d85ad15b4
SHA512b94df4cb1a6deea3c4ac0cd73f006c48964c9c655ea260db46ec8c9e457ef74ca72eb57e2966caeee15c8029d22b529f10c37cb27f4ab99fa4f01857cc0135ce
-
memory/1400-123-0x000000000A240000-0x000000000A2D2000-memory.dmpFilesize
584KB
-
memory/1400-124-0x0000000006650000-0x00000000066B9000-memory.dmpFilesize
420KB
-
memory/1400-119-0x0000000007DA0000-0x0000000007DA1000-memory.dmpFilesize
4KB
-
memory/1400-120-0x0000000007CB0000-0x0000000007CB1000-memory.dmpFilesize
4KB
-
memory/1400-121-0x0000000007F60000-0x0000000007F61000-memory.dmpFilesize
4KB
-
memory/1400-122-0x000000000A1F0000-0x000000000A200000-memory.dmpFilesize
64KB
-
memory/1400-114-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/1400-118-0x00000000082A0000-0x00000000082A1000-memory.dmpFilesize
4KB
-
memory/1400-116-0x0000000007950000-0x0000000007951000-memory.dmpFilesize
4KB
-
memory/1400-117-0x0000000007D00000-0x0000000007D01000-memory.dmpFilesize
4KB
-
memory/2256-125-0x0000000000000000-mapping.dmp
-
memory/3620-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3620-128-0x00000000004375DE-mapping.dmp
-
memory/3620-134-0x0000000004F00000-0x00000000053FE000-memory.dmpFilesize
5.0MB
-
memory/3620-135-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/3620-136-0x0000000005BA0000-0x0000000005BA1000-memory.dmpFilesize
4KB