8a56d6baa1eac6ca6208e74591221cbc

General
Target

8a56d6baa1eac6ca6208e74591221cbc.exe

Filesize

763KB

Completed

27-07-2021 16:36

Score
10 /10
MD5

8a56d6baa1eac6ca6208e74591221cbc

SHA1

9f057b5a90fdcee33dc2fa4f8f3424a3345186dd

SHA256

61ee3545921c4ddf2a41826b2425dc43b4902353a01798f5516e9afdf4a10d63

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.privateemail.com

Port: 587

Username: chamara.kuruppu@organigram-ca.icu

Password: HELPMEGOD@1321

Signatures 9

Filter: none

Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1796-68-0x000000000043748E-mapping.dmpfamily_agenttesla
    behavioral1/memory/1796-67-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral1/memory/1796-69-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
  • CustAttr .NET packer

    Description

    Detects CustAttr .NET packer in memory.

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1564-62-0x00000000003D0000-0x00000000003DB000-memory.dmpCustAttr
  • Suspicious use of SetThreadContext
    8a56d6baa1eac6ca6208e74591221cbc.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1564 set thread context of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    568schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    8a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe

    Reported IOCs

    pidprocess
    15648a56d6baa1eac6ca6208e74591221cbc.exe
    17968a56d6baa1eac6ca6208e74591221cbc.exe
    17968a56d6baa1eac6ca6208e74591221cbc.exe
  • Suspicious use of AdjustPrivilegeToken
    8a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege15648a56d6baa1eac6ca6208e74591221cbc.exe
    Token: SeDebugPrivilege17968a56d6baa1eac6ca6208e74591221cbc.exe
  • Suspicious use of WriteProcessMemory
    8a56d6baa1eac6ca6208e74591221cbc.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1564 wrote to memory of 56815648a56d6baa1eac6ca6208e74591221cbc.exeschtasks.exe
    PID 1564 wrote to memory of 56815648a56d6baa1eac6ca6208e74591221cbc.exeschtasks.exe
    PID 1564 wrote to memory of 56815648a56d6baa1eac6ca6208e74591221cbc.exeschtasks.exe
    PID 1564 wrote to memory of 56815648a56d6baa1eac6ca6208e74591221cbc.exeschtasks.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
    PID 1564 wrote to memory of 179615648a56d6baa1eac6ca6208e74591221cbc.exe8a56d6baa1eac6ca6208e74591221cbc.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\8a56d6baa1eac6ca6208e74591221cbc.exe
    "C:\Users\Admin\AppData\Local\Temp\8a56d6baa1eac6ca6208e74591221cbc.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wfjFhTUFwiTLXg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B81.tmp"
      Creates scheduled task(s)
      PID:568
    • C:\Users\Admin\AppData\Local\Temp\8a56d6baa1eac6ca6208e74591221cbc.exe
      "C:\Users\Admin\AppData\Local\Temp\8a56d6baa1eac6ca6208e74591221cbc.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1796
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmp4B81.tmp

                        MD5

                        843ac3cae11889f5746e81b7f23c3365

                        SHA1

                        84df7cf91ab49b07657d82394912ea7ba917217c

                        SHA256

                        56d51d84f374b8bbe27bfce2ddf08731f8c9dd188a1c3cf10478be772b5c5f65

                        SHA512

                        c21b4fca15009be30904ee267a90cc6b72904e23ca1956199a12f3ac5bcb22722494b5144b19435578e9b36f44b8e602ab01c362baeb06284b851c9e86d73151

                      • memory/568-65-0x0000000000000000-mapping.dmp

                      • memory/1564-61-0x0000000004D30000-0x0000000004D31000-memory.dmp

                      • memory/1564-62-0x00000000003D0000-0x00000000003DB000-memory.dmp

                      • memory/1564-63-0x0000000008030000-0x00000000080B2000-memory.dmp

                      • memory/1564-64-0x0000000000640000-0x000000000067D000-memory.dmp

                      • memory/1564-59-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                      • memory/1796-68-0x000000000043748E-mapping.dmp

                      • memory/1796-67-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/1796-69-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/1796-71-0x0000000001FC0000-0x0000000001FC1000-memory.dmp