Analysis
-
max time kernel
146s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 16:02
Static task
static1
Behavioral task
behavioral1
Sample
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe
Resource
win10v20210410
General
-
Target
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe
-
Size
1017KB
-
MD5
e2e3079ac8c5cbbcc7073ca306ab42ac
-
SHA1
5236549f1fbe0f93f4bde89e6e96a34ff98894c3
-
SHA256
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2
-
SHA512
84743366be0864382a0e6ad02a0c6440a31686d50ce1c40f5014e2456c0daaca6a74f8fd28373bd0bb739dacf1f4b8932fad5f18f3554fac67f46bff5c2d9d6c
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://fashionandsorucing.com/ - Port:
21 - Username:
Farmlogs@fashionandsorucing.com - Password:
MNZsxGLNtfYc
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/748-128-0x00000000004375EE-mapping.dmp family_agenttesla behavioral2/memory/748-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\hZpzJs = "C:\\Users\\Admin\\AppData\\Roaming\\hZpzJs\\hZpzJs.exe" 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exedescription pid process target process PID 3156 set thread context of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exepid process 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 748 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 748 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exepid process 748 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exedescription pid process Token: SeDebugPrivilege 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe Token: SeDebugPrivilege 748 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exedescription pid process target process PID 3156 wrote to memory of 3364 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe schtasks.exe PID 3156 wrote to memory of 3364 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe schtasks.exe PID 3156 wrote to memory of 3364 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe schtasks.exe PID 3156 wrote to memory of 3268 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 3268 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 3268 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe PID 3156 wrote to memory of 748 3156 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe 494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe"C:\Users\Admin\AppData\Local\Temp\494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\naddtc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC6B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe"C:\Users\Admin\AppData\Local\Temp\494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe"C:\Users\Admin\AppData\Local\Temp\494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Temp\tmpBC6B.tmpMD5
0e2f5bf4696e49f04b8b23963165f438
SHA1ba05a1eba0d70e7bf07050bbb38a804439e3c3c0
SHA25608db537660467962f0f1e49e6e00fa576024b215bb79cb13fa7b16c5a4a836c6
SHA512088dc4b1656b2f5f699479afbcca1a3f9aa86c58169ee8f42c3990fb62c923da92b456e6dfecfd6d2f6ebef73a87ba04f89505439097e6f50be17776462fd80a
-
memory/748-136-0x0000000006420000-0x0000000006421000-memory.dmpFilesize
4KB
-
memory/748-135-0x0000000005D30000-0x0000000005D31000-memory.dmpFilesize
4KB
-
memory/748-134-0x00000000030C0000-0x00000000030C1000-memory.dmpFilesize
4KB
-
memory/748-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/748-128-0x00000000004375EE-mapping.dmp
-
memory/3156-119-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/3156-123-0x0000000006F10000-0x0000000006F89000-memory.dmpFilesize
484KB
-
memory/3156-124-0x0000000006FD0000-0x0000000007012000-memory.dmpFilesize
264KB
-
memory/3156-122-0x0000000004CD0000-0x00000000051CE000-memory.dmpFilesize
5.0MB
-
memory/3156-121-0x0000000005040000-0x000000000505B000-memory.dmpFilesize
108KB
-
memory/3156-120-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/3156-114-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/3156-118-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/3156-117-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/3156-116-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/3364-125-0x0000000000000000-mapping.dmp