e33ac82c14447959cb7aed86bd915960

General
Target

e33ac82c14447959cb7aed86bd915960.exe

Filesize

684KB

Completed

27-07-2021 16:06

Score
10 /10
MD5

e33ac82c14447959cb7aed86bd915960

SHA1

9ea25902ed4f55813ae2708ce237bbf3b89f924a

SHA256

3bcc082fdf8172ec9014d27d75cd67698ac1f27228a698849fad2a56fe94ca0f

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.privateemail.com

Port: 587

Username: ddelande@quadrel-com.icu

Password: snookiep@123

Signatures 9

Filter: none

Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3972-127-0x000000000043749E-mapping.dmpfamily_agenttesla
    behavioral2/memory/3972-126-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral2/memory/3972-132-0x0000000004F90000-0x000000000548E000-memory.dmpfamily_agenttesla
  • CustAttr .NET packer

    Description

    Detects CustAttr .NET packer in memory.

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/4448-121-0x0000000005090000-0x000000000509B000-memory.dmpCustAttr
  • Suspicious use of SetThreadContext
    e33ac82c14447959cb7aed86bd915960.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4448 set thread context of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    4008schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe

    Reported IOCs

    pidprocess
    4448e33ac82c14447959cb7aed86bd915960.exe
    3972e33ac82c14447959cb7aed86bd915960.exe
    3972e33ac82c14447959cb7aed86bd915960.exe
  • Suspicious use of AdjustPrivilegeToken
    e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege4448e33ac82c14447959cb7aed86bd915960.exe
    Token: SeDebugPrivilege3972e33ac82c14447959cb7aed86bd915960.exe
  • Suspicious use of WriteProcessMemory
    e33ac82c14447959cb7aed86bd915960.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4448 wrote to memory of 40084448e33ac82c14447959cb7aed86bd915960.exeschtasks.exe
    PID 4448 wrote to memory of 40084448e33ac82c14447959cb7aed86bd915960.exeschtasks.exe
    PID 4448 wrote to memory of 40084448e33ac82c14447959cb7aed86bd915960.exeschtasks.exe
    PID 4448 wrote to memory of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 4448 wrote to memory of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 4448 wrote to memory of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 4448 wrote to memory of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 4448 wrote to memory of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 4448 wrote to memory of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 4448 wrote to memory of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
    PID 4448 wrote to memory of 39724448e33ac82c14447959cb7aed86bd915960.exee33ac82c14447959cb7aed86bd915960.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\e33ac82c14447959cb7aed86bd915960.exe
    "C:\Users\Admin\AppData\Local\Temp\e33ac82c14447959cb7aed86bd915960.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pcEyxzuZDY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA0C5.tmp"
      Creates scheduled task(s)
      PID:4008
    • C:\Users\Admin\AppData\Local\Temp\e33ac82c14447959cb7aed86bd915960.exe
      "C:\Users\Admin\AppData\Local\Temp\e33ac82c14447959cb7aed86bd915960.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3972
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmpA0C5.tmp

                        MD5

                        74195508bc7a47c97354fc0a136fd80a

                        SHA1

                        50aa667dfe17d6a22f739e2b4ac54afa7a96ebb7

                        SHA256

                        5cb166e7cf108c28cd33aedf118a752897b13f1ae87bf73671ce887f75df7add

                        SHA512

                        f672b751f056fa21a2eb9ece8e31c1b11694b4770dcdaea1d4aeb15b083f6b49212aaaa833549197949ed6f7e83dc60b90978b24136784c6613a4d0887334fbf

                      • memory/3972-134-0x0000000005D10000-0x0000000005D11000-memory.dmp

                      • memory/3972-133-0x0000000005C80000-0x0000000005C81000-memory.dmp

                      • memory/3972-132-0x0000000004F90000-0x000000000548E000-memory.dmp

                      • memory/3972-126-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/3972-127-0x000000000043749E-mapping.dmp

                      • memory/4008-124-0x0000000000000000-mapping.dmp

                      • memory/4448-123-0x00000000072A0000-0x00000000072DD000-memory.dmp

                      • memory/4448-122-0x0000000007200000-0x0000000007281000-memory.dmp

                      • memory/4448-121-0x0000000005090000-0x000000000509B000-memory.dmp

                      • memory/4448-120-0x0000000004B40000-0x0000000004B41000-memory.dmp

                      • memory/4448-119-0x0000000004B80000-0x0000000004B81000-memory.dmp

                      • memory/4448-118-0x0000000004C40000-0x0000000004C41000-memory.dmp

                      • memory/4448-117-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                      • memory/4448-116-0x00000000050A0000-0x00000000050A1000-memory.dmp

                      • memory/4448-114-0x0000000000260000-0x0000000000261000-memory.dmp