Overview

overview

10

Static

static

fda.exe

windows7_x64

10

fda.exe

windows10_x64

10
General
Target

fda.exe

Filesize

909KB

Completed

27-07-2021 15:05

Task

behavioral1

Score
10/10
MD5

9988685bdb69c34939c270df2eff6d47

SHA1

b4aa67fe963f14a8ac6220d8953960a86d7bcdd1

SHA256

f367ab08d8884ebda2ca7101fa509d1216f66c9e788d1b729ce605959f2f57ca

SHA256

c535fec6cffebc266858e46d6ef8b6405a2ac9e50d946d40faf64131eb866611d32b1d9906c70923f075d00e2e88c74afb284d198277c4ef0abaaa24ff9ded7b

Malware Config

Extracted

Family

agenttesla
Credentials

Protocol: smtp

Host: smtp.vivaldi.net

Port: 587

Username: faithkingsley@vivaldi.net

Password: kingsofkings123
Signatures 11

Filter: none

Defense Evasion
Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    Tags

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1472-68-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral1/memory/1472-69-0x000000000043782E-mapping.dmpfamily_agenttesla
    behavioral1/memory/1472-70-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
  • Drops file in Drivers directory
    RegSvcs.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\system32\drivers\etc\hostsRegSvcs.exe
  • Adds Run key to start application
    RegSvcs.exe

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\DLxES = "C:\\Users\\Admin\\AppData\\Roaming\\DLxES\\DLxES.exe"RegSvcs.exe
  • Suspicious use of SetThreadContext
    fda.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 784 set thread context of 1472784fda.exeRegSvcs.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    Tags

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    564schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    fda.exeRegSvcs.exe

    Reported IOCs

    pidprocess
    784fda.exe
    784fda.exe
    1472RegSvcs.exe
    1472RegSvcs.exe
  • Suspicious use of AdjustPrivilegeToken
    fda.exeRegSvcs.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege784fda.exe
    Token: SeDebugPrivilege1472RegSvcs.exe
  • Suspicious use of SetWindowsHookEx
    RegSvcs.exe

    Reported IOCs

    pidprocess
    1472RegSvcs.exe
  • Suspicious use of WriteProcessMemory
    fda.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 784 wrote to memory of 564784fda.exeschtasks.exe
    PID 784 wrote to memory of 564784fda.exeschtasks.exe
    PID 784 wrote to memory of 564784fda.exeschtasks.exe
    PID 784 wrote to memory of 564784fda.exeschtasks.exe
    PID 784 wrote to memory of 976784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 976784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 976784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 976784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 976784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 976784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 976784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
    PID 784 wrote to memory of 1472784fda.exeRegSvcs.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\fda.exe
    "C:\Users\Admin\AppData\Local\Temp\fda.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:784
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XwsFwyhNyFwyE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE24.tmp"
      Creates scheduled task(s)
      PID:564
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      PID:976
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      Drops file in Drivers directory
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1472
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\tmpE24.tmp

                      MD5

                      c4215e4e7a05809def3c18da6604f395

                      SHA1

                      575071deecbdeea803f31a5663d32ed434fe182e

                      SHA256

                      f3dc81b24c498e852984182b85da85d2feee07ff03818fe04e673343891bc9ff

                      SHA512

                      941d0080b859c48adcbf444ee2e9e4cc202fc01a7d2ca1ed986c5a1c412c4974e9fd76b949d5621be2cede8b3e907ff80c6d5c3748c3b0ea8f6d58393b0a104b

                      Download Submit

                    • memory/564-66-0x0000000000000000-mapping.dmp

                      Download

                    • memory/784-62-0x0000000004A70000-0x0000000004A71000-memory.dmp

                      Download

                    • memory/784-63-0x00000000004E0000-0x00000000004E2000-memory.dmp

                      Download

                    • memory/784-64-0x00000000052D0000-0x0000000005386000-memory.dmp

                      Download

                    • memory/784-65-0x00000000058D0000-0x0000000005942000-memory.dmp

                      Download

                    • memory/784-60-0x00000000000A0000-0x00000000000A1000-memory.dmp

                      Download

                    • memory/1472-68-0x0000000000400000-0x000000000043C000-memory.dmp

                      Download

                    • memory/1472-69-0x000000000043782E-mapping.dmp

                      Download

                    • memory/1472-70-0x0000000000400000-0x000000000043C000-memory.dmp

                      Download

                    • memory/1472-72-0x0000000004860000-0x0000000004861000-memory.dmp

                      Download

                    • memory/1472-73-0x0000000004861000-0x0000000004862000-memory.dmp

                      Download