Analysis
-
max time kernel
146s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 20:26
General
-
Target
DHL-AW1258901FE2021_pdf.exe
-
Size
797KB
-
MD5
8ae76778cf4bd4ea09d7c6fe8e5ceb7c
-
SHA1
c81411a8d7abcd68fcec07a67dd33a520767f8e3
-
SHA256
4d50e241422bc31d14cac7c4fafc411b53e165e27e6f70f33ce0c4266b817157
-
SHA512
05a76a99b07c2402b87f0f1424161ed24070eb88598f2ab3943ec6ace1febb2e734290e4e49137748a5e6c35c1808f4e35f415f546d6a89a347ff0afec4bc000
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtpout.secureserver.net - Port:
587 - Username:
sales1@ashtavinayaka.com - Password:
123456789
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL-AW1258901FE2021_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL-AW1258901FE2021_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tshiAyXHtrWPz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7262.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\DHL-AW1258901FE2021_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL-AW1258901FE2021_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DHL-AW1258901FE2021_pdf.exe.logMD5
5e7bb97636a484b5a87e60373614279a
SHA136bfdec32eedb141a4a106d89a453326f62593ee
SHA25612ed6e1df2c57556c59dfd6630fd454a9df76166f340c41ee6bc54d98e709e20
SHA512448c62d538e646045d7315ff902b86f614e2dc1eb0959c22c6618fd2c8767c330d24692357559310e6b55b0c35415a14a6ab2d6d9b8d2a03186949b97190fd56
-
C:\Users\Admin\AppData\Local\Temp\tmp7262.tmpMD5
8b33fb970a2e7b2b6d4a1a51dcb118de
SHA13c0f70995cc9c2c39c072454f29c949c2f3cd65f
SHA256c3a7b570b2a1aaff5fded0ebb6bc46689c780e2333be6cc9a62a014e7ca24c1f
SHA5127e56777f653e02db081fb3bc21f2a0b4258328e4ef13cd4a1e7527525ccb391a33aa695bd61b24f5359377c0a42828b2055d83ca28d158c6c6698603ccdde624
-
memory/196-116-0x0000000000000000-mapping.dmp
-
memory/808-114-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/808-115-0x0000000001081000-0x0000000001082000-memory.dmpFilesize
4KB
-
memory/1516-118-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1516-119-0x00000000004374EE-mapping.dmp
-
memory/1516-121-0x0000000002920000-0x0000000002921000-memory.dmpFilesize
4KB
-
memory/1516-122-0x0000000002921000-0x0000000002922000-memory.dmpFilesize
4KB
-
memory/1516-123-0x0000000002922000-0x0000000002923000-memory.dmpFilesize
4KB