Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-07-2021 05:32
Static task
static1
Behavioral task
behavioral1
Sample
BANK DETAILS.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
BANK DETAILS.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
BANK DETAILS.exe
-
Size
894KB
-
MD5
fb06ed245f080393bbfe1ae577053085
-
SHA1
a003c960669f5a64ae182dcfc9d7185750a84f0d
-
SHA256
2f639103b3a2a16f0eacad22c7df0a037c3a45d74cfe09ce96f86e13fe74a1b8
-
SHA512
cf75bb4fe26c743c3e448700a7baccb233f82113562afd46836beebe0593a21adc34d15de9dfa7918a034b6b75a8e2a4c989391c1b3dcf08a17dc8b0983932e3
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.framafilms.com - Port:
587 - Username:
framafilmsint@framafilms.com - Password:
lister11
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2452-115-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2452-116-0x00000000004374EE-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BANK DETAILS.exedescription pid process target process PID 1404 set thread context of 2452 1404 BANK DETAILS.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2452 RegSvcs.exe 2452 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2452 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
BANK DETAILS.exedescription pid process target process PID 1404 wrote to memory of 2452 1404 BANK DETAILS.exe RegSvcs.exe PID 1404 wrote to memory of 2452 1404 BANK DETAILS.exe RegSvcs.exe PID 1404 wrote to memory of 2452 1404 BANK DETAILS.exe RegSvcs.exe PID 1404 wrote to memory of 2452 1404 BANK DETAILS.exe RegSvcs.exe PID 1404 wrote to memory of 2452 1404 BANK DETAILS.exe RegSvcs.exe PID 1404 wrote to memory of 2452 1404 BANK DETAILS.exe RegSvcs.exe PID 1404 wrote to memory of 2452 1404 BANK DETAILS.exe RegSvcs.exe PID 1404 wrote to memory of 2452 1404 BANK DETAILS.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BANK DETAILS.exe"C:\Users\Admin\AppData\Local\Temp\BANK DETAILS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1404-114-0x00000000019E0000-0x00000000019E1000-memory.dmpFilesize
4KB
-
memory/2452-115-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2452-116-0x00000000004374EE-mapping.dmp
-
memory/2452-117-0x0000000003040000-0x0000000003041000-memory.dmpFilesize
4KB
-
memory/2452-118-0x0000000003041000-0x0000000003042000-memory.dmpFilesize
4KB
-
memory/2452-119-0x0000000003042000-0x0000000003043000-memory.dmpFilesize
4KB