Analysis
-
max time kernel
91s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-06-2021 12:08
General
-
Target
NEW ORDER PO# 3038280_PRO61821 EMS INC.exe
-
Size
264KB
-
MD5
a299c284634648f50d6854de78eb7e6e
-
SHA1
0bb3a590fde54d3310151411cb740651e4ffc370
-
SHA256
85c5f35470f6e7921ec125f8c7e103c9f32b22e369634f2706f98949f676641f
-
SHA512
4e637f8d7b4a6a0292d8da4b0a8f31bdedb964226c113a5acd57fa8252be454e1b2d7b06565cd5582e1bca39a5b9af8075e948f68fa15755dd2ca1c7b3c107cb
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cairoshippinginternational.com - Port:
587 - Username:
samy@cairoshippinginternational.com - Password:
NermoSamy@2006+
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER PO# 3038280_PRO61821 EMS INC.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER PO# 3038280_PRO61821 EMS INC.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER PO# 3038280_PRO61821 EMS INC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nscDE2.tmp\System.dllMD5
56a321bd011112ec5d8a32b2f6fd3231
SHA1df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA5125354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
-
\Users\Admin\AppData\Local\Temp\nscDE2.tmp\System.dllMD5
56a321bd011112ec5d8a32b2f6fd3231
SHA1df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA5125354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
-
memory/2104-116-0x000000000043762E-mapping.dmp
-
memory/2104-117-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2104-119-0x0000000005CA0000-0x0000000005CA1000-memory.dmpFilesize
4KB
-
memory/2104-120-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/2104-121-0x00000000057A0000-0x0000000005C9E000-memory.dmpFilesize
5.0MB
-
memory/2104-122-0x0000000005BF0000-0x0000000005BF1000-memory.dmpFilesize
4KB
-
memory/2104-123-0x0000000006590000-0x0000000006591000-memory.dmpFilesize
4KB
-
memory/2104-124-0x0000000006C70000-0x0000000006C71000-memory.dmpFilesize
4KB
-
memory/2104-125-0x0000000002F80000-0x0000000002F81000-memory.dmpFilesize
4KB