Analysis
-
max time kernel
99s -
max time network
47s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 15:06
Static task
static1
Behavioral task
behavioral1
Sample
PO 98246.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PO 98246.exe
Resource
win10v20210408
General
-
Target
PO 98246.exe
-
Size
940KB
-
MD5
87fb6b88ed5e0ad768dd1fb8fc9c46af
-
SHA1
739749390782129616a8a776ff745a748de3048a
-
SHA256
9cb1e7f66fe3c5e0ba2e1d525dddf593ceb57df41a49b874228c61322e6a4861
-
SHA512
e3c4177f3de2aecb953b0f6efed90d969e9a3d4254985ad4ae58a917554961164321570fcf83ae8e5d95c6c5f9fc008ce2c241faaad28c9b01bbc3f82d081ef5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
paola.micheli@copangroup.xyz - Password:
gibson.1990
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1960-66-0x000000000043760E-mapping.dmp family_agenttesla behavioral1/memory/1960-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1960-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
PO 98246.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts PO 98246.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PO 98246.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe" PO 98246.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 98246.exedescription pid process target process PID 1908 set thread context of 1960 1908 PO 98246.exe PO 98246.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO 98246.exepid process 1960 PO 98246.exe 1960 PO 98246.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO 98246.exedescription pid process Token: SeDebugPrivilege 1960 PO 98246.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
PO 98246.exedescription pid process target process PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe PID 1908 wrote to memory of 1960 1908 PO 98246.exe PO 98246.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1908-60-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/1908-62-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/1908-63-0x0000000000AA0000-0x0000000000B08000-memory.dmpFilesize
416KB
-
memory/1908-64-0x00000000001F0000-0x00000000001FF000-memory.dmpFilesize
60KB
-
memory/1960-66-0x000000000043760E-mapping.dmp
-
memory/1960-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1960-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1960-69-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/1960-70-0x00000000022D1000-0x00000000022D2000-memory.dmpFilesize
4KB