Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 20:12
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Details.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Consignment Details.exe
Resource
win10v20210410
General
-
Target
Consignment Details.exe
-
Size
1.1MB
-
MD5
890a8a2e14292586f963871fc5467cc9
-
SHA1
e4a5c3ba74c7e20814c6de8c254d96663f2bd2de
-
SHA256
c5076cfbad60581baea1cd2e129c832da3f6f616902490c0877132411473a9ac
-
SHA512
606542a87bad7d06e05d18e646edd0a7e3816b0c376fb58d2397a9370026e677a8d5a525f1bf45ebc9d83bb61231c002b991a1371a34f440669d8e5a8ea4bf1c
Malware Config
Extracted
agenttesla
http://6llion.com//inc/cbc38431b42dd0.php
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/768-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/768-68-0x0000000000436EFE-mapping.dmp family_agenttesla behavioral1/memory/768-69-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Consignment Details.exedescription pid process target process PID 452 set thread context of 768 452 Consignment Details.exe Consignment Details.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Consignment Details.exepid process 768 Consignment Details.exe 768 Consignment Details.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Consignment Details.exedescription pid process Token: SeDebugPrivilege 768 Consignment Details.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Consignment Details.exepid process 768 Consignment Details.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Consignment Details.exedescription pid process target process PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe PID 452 wrote to memory of 768 452 Consignment Details.exe Consignment Details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/452-60-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/452-62-0x0000000004A20000-0x0000000004B03000-memory.dmpFilesize
908KB
-
memory/452-63-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/452-64-0x0000000000270000-0x0000000000281000-memory.dmpFilesize
68KB
-
memory/452-65-0x0000000016450000-0x00000000164CC000-memory.dmpFilesize
496KB
-
memory/452-66-0x0000000000560000-0x000000000059A000-memory.dmpFilesize
232KB
-
memory/768-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/768-68-0x0000000000436EFE-mapping.dmp
-
memory/768-69-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/768-71-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB