Analysis
-
max time kernel
99s -
max time network
41s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 19:03
Static task
static1
Behavioral task
behavioral1
Sample
affd8e6bdc328d5db92a6ae4d210f916.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
affd8e6bdc328d5db92a6ae4d210f916.exe
Resource
win10v20210408
General
-
Target
affd8e6bdc328d5db92a6ae4d210f916.exe
-
Size
1.1MB
-
MD5
affd8e6bdc328d5db92a6ae4d210f916
-
SHA1
3abb4b3cb1ad4d12c81d611623973e8401e3e23b
-
SHA256
04cdbb87050fa773ed542d18c1993851661cdebcd06acb6af05bd9e03d14a1c8
-
SHA512
a6601b3d1bfa896c9284e35026f032ab2073f855be0e6a1354f1c8c86dff6e0e33c1471f062b81610ffd3e4133806de14edbd17b9e2ea21db424fa8ae10731eb
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
miratechs.gq - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/756-66-0x000000000043776E-mapping.dmp family_agenttesla behavioral1/memory/756-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/756-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
affd8e6bdc328d5db92a6ae4d210f916.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts affd8e6bdc328d5db92a6ae4d210f916.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
affd8e6bdc328d5db92a6ae4d210f916.exedescription pid process target process PID 1088 set thread context of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
affd8e6bdc328d5db92a6ae4d210f916.exepid process 756 affd8e6bdc328d5db92a6ae4d210f916.exe 756 affd8e6bdc328d5db92a6ae4d210f916.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
affd8e6bdc328d5db92a6ae4d210f916.exedescription pid process Token: SeDebugPrivilege 756 affd8e6bdc328d5db92a6ae4d210f916.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
affd8e6bdc328d5db92a6ae4d210f916.exedescription pid process target process PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe PID 1088 wrote to memory of 756 1088 affd8e6bdc328d5db92a6ae4d210f916.exe affd8e6bdc328d5db92a6ae4d210f916.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\affd8e6bdc328d5db92a6ae4d210f916.exe"C:\Users\Admin\AppData\Local\Temp\affd8e6bdc328d5db92a6ae4d210f916.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\affd8e6bdc328d5db92a6ae4d210f916.exe"C:\Users\Admin\AppData\Local\Temp\affd8e6bdc328d5db92a6ae4d210f916.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/756-66-0x000000000043776E-mapping.dmp
-
memory/756-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/756-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/756-69-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/1088-59-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/1088-61-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/1088-62-0x0000000000610000-0x000000000062B000-memory.dmpFilesize
108KB
-
memory/1088-63-0x00000000059B0000-0x0000000005A5E000-memory.dmpFilesize
696KB
-
memory/1088-64-0x0000000004F10000-0x0000000004F79000-memory.dmpFilesize
420KB