e33ac82c14447959cb7aed86bd915960

General
Target

e33ac82c14447959cb7aed86bd915960.exe

Filesize

684KB

Completed

27-07-2021 16:07

Score
10 /10
MD5

e33ac82c14447959cb7aed86bd915960

SHA1

9ea25902ed4f55813ae2708ce237bbf3b89f924a

SHA256

3bcc082fdf8172ec9014d27d75cd67698ac1f27228a698849fad2a56fe94ca0f

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.privateemail.com

Port: 587

Username: ddelande@quadrel-com.icu

Password: snookiep@123

Signatures 9

Filter: none

Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1956-67-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral1/memory/1956-68-0x000000000043749E-mapping.dmpfamily_agenttesla
    behavioral1/memory/1956-69-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
  • CustAttr .NET packer

    Description

    Detects CustAttr .NET packer in memory.

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1972-62-0x0000000000840000-0x000000000084B000-memory.dmpCustAttr
  • Suspicious use of SetThreadContext
    e33ac82c14447959cb7aed86bd915960.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1972 set thread context of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    560schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe

    Reported IOCs

    pidprocess
    1972e33ac82c14447959cb7aed86bd915960.exe
    1956e33ac82c14447959cb7aed86bd915960.exe
    1956e33ac82c14447959cb7aed86bd915960.exe
  • Suspicious use of AdjustPrivilegeToken
    e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1972e33ac82c14447959cb7aed86bd915960.exe
    Token: SeDebugPrivilege1956e33ac82c14447959cb7aed86bd915960.exe
  • Suspicious use of WriteProcessMemory
    e33ac82c14447959cb7aed86bd915960.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1972 wrote to memory of 5601972e33ac82c14447959cb7aed86bd915960.exeschtasks.exe
    PID 1972 wrote to memory of 5601972e33ac82c14447959cb7aed86bd915960.exeschtasks.exe
    PID 1972 wrote to memory of 5601972e33ac82c14447959cb7aed86bd915960.exeschtasks.exe
    PID 1972 wrote to memory of 5601972e33ac82c14447959cb7aed86bd915960.exeschtasks.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 1972 wrote to memory of 19561972e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\e33ac82c14447959cb7aed86bd915960.exe
    "C:\Users\Admin\AppData\Local\Temp\e33ac82c14447959cb7aed86bd915960.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pcEyxzuZDY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E77.tmp"
      Creates scheduled task(s)
      PID:560
    • C:\Users\Admin\AppData\Local\Temp\e33ac82c14447959cb7aed86bd915960.exe
      "C:\Users\Admin\AppData\Local\Temp\e33ac82c14447959cb7aed86bd915960.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1956
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmp3E77.tmp

                        MD5

                        4e5f0f21e8d0d3214b6cf83b6f965932

                        SHA1

                        ac90f258e3f5b2071e8adef44480addc37519218

                        SHA256

                        193158019e690e03bb1b0a4003565e3350a24a3bc4e0c01b0c997f87bba74921

                        SHA512

                        cb852fe1408d439c5e9108347d64c158f63faa537960396ed494deaeb8aca9c34f80fd35904540a1974fa85a9203bcf8193469fb07c89be97a24bf99d3da63f0

                      • memory/560-65-0x0000000000000000-mapping.dmp

                      • memory/1956-67-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/1956-68-0x000000000043749E-mapping.dmp

                      • memory/1956-69-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/1956-71-0x0000000004A60000-0x0000000004A61000-memory.dmp

                      • memory/1972-59-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

                      • memory/1972-61-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                      • memory/1972-62-0x0000000000840000-0x000000000084B000-memory.dmp

                      • memory/1972-63-0x0000000004D10000-0x0000000004D91000-memory.dmp

                      • memory/1972-64-0x0000000000C00000-0x0000000000C3D000-memory.dmp