PO OPOR20068.exe

General
Target

PO OPOR20068.exe

Filesize

724KB

Completed

27-07-2021 16:06

Score
10 /10
MD5

c62b99c24181e32a199909b7abc7bfe2

SHA1

612ba065ee0abdacbace51cc127cc6f10675836a

SHA256

904ce2cc4a696ddc786ab3a74f7e301e49ff555bac6f2658a336b408db927777

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: webmail.worldlinkcolombo.net

Port: 587

Username: pamuditha@worldlinkcolombo.net

Password: FBF8TNIO60WI6615677789

Signatures 6

Filter: none

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/2892-125-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral2/memory/2892-126-0x000000000043764E-mapping.dmpfamily_agenttesla
    behavioral2/memory/2892-132-0x0000000004FB0000-0x00000000054AE000-memory.dmpfamily_agenttesla
  • Suspicious use of SetThreadContext
    PO OPOR20068.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3492 set thread context of 28923492PO OPOR20068.exePO OPOR20068.exe
  • Suspicious behavior: EnumeratesProcesses
    PO OPOR20068.exe

    Reported IOCs

    pidprocess
    2892PO OPOR20068.exe
    2892PO OPOR20068.exe
  • Suspicious use of AdjustPrivilegeToken
    PO OPOR20068.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2892PO OPOR20068.exe
  • Suspicious use of WriteProcessMemory
    PO OPOR20068.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3492 wrote to memory of 28923492PO OPOR20068.exePO OPOR20068.exe
    PID 3492 wrote to memory of 28923492PO OPOR20068.exePO OPOR20068.exe
    PID 3492 wrote to memory of 28923492PO OPOR20068.exePO OPOR20068.exe
    PID 3492 wrote to memory of 28923492PO OPOR20068.exePO OPOR20068.exe
    PID 3492 wrote to memory of 28923492PO OPOR20068.exePO OPOR20068.exe
    PID 3492 wrote to memory of 28923492PO OPOR20068.exePO OPOR20068.exe
    PID 3492 wrote to memory of 28923492PO OPOR20068.exePO OPOR20068.exe
    PID 3492 wrote to memory of 28923492PO OPOR20068.exePO OPOR20068.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\PO OPOR20068.exe
    "C:\Users\Admin\AppData\Local\Temp\PO OPOR20068.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\PO OPOR20068.exe
      "C:\Users\Admin\AppData\Local\Temp\PO OPOR20068.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2892
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO OPOR20068.exe.log

                            MD5

                            90acfd72f14a512712b1a7380c0faf60

                            SHA1

                            40ba4accb8faa75887e84fb8e38d598dc8cf0f12

                            SHA256

                            20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

                            SHA512

                            29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

                          • memory/2892-134-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

                          • memory/2892-133-0x00000000050F0000-0x00000000050F1000-memory.dmp

                          • memory/2892-132-0x0000000004FB0000-0x00000000054AE000-memory.dmp

                          • memory/2892-126-0x000000000043764E-mapping.dmp

                          • memory/2892-125-0x0000000000400000-0x000000000043C000-memory.dmp

                          • memory/3492-123-0x0000000000CB0000-0x0000000000D2C000-memory.dmp

                          • memory/3492-122-0x00000000051C0000-0x00000000051DB000-memory.dmp

                          • memory/3492-121-0x0000000005110000-0x0000000005111000-memory.dmp

                          • memory/3492-124-0x0000000000D30000-0x0000000000D6D000-memory.dmp

                          • memory/3492-120-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                          • memory/3492-119-0x0000000004F10000-0x000000000540E000-memory.dmp

                          • memory/3492-118-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                          • memory/3492-117-0x0000000005410000-0x0000000005411000-memory.dmp

                          • memory/3492-116-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                          • memory/3492-114-0x0000000000420000-0x0000000000421000-memory.dmp