ea4d96f213ca97ecc5dcbffe408ff2bf

General
Target

ea4d96f213ca97ecc5dcbffe408ff2bf.exe

Filesize

645KB

Completed

27-07-2021 16:16

Score
10 /10
MD5

ea4d96f213ca97ecc5dcbffe408ff2bf

SHA1

3b3cbeb4060970f0d349e6ec37a20cf1285800b7

SHA256

aa49a468dd184ec1ee4b126823e7c3dec0539e75b0736b6f2a24116fc33badb9

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.privateemail.com

Port: 587

Username: max.mccanna@metaltek.me

Password: GODGRACE12345

Signatures 9

Filter: none

Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/572-68-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral1/memory/572-69-0x00000000004374BE-mapping.dmpfamily_agenttesla
    behavioral1/memory/572-70-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
  • CustAttr .NET packer

    Description

    Detects CustAttr .NET packer in memory.

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2028-63-0x0000000000490000-0x000000000049B000-memory.dmpCustAttr
  • Suspicious use of SetThreadContext
    ea4d96f213ca97ecc5dcbffe408ff2bf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2028 set thread context of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    268schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe

    Reported IOCs

    pidprocess
    2028ea4d96f213ca97ecc5dcbffe408ff2bf.exe
    572ea4d96f213ca97ecc5dcbffe408ff2bf.exe
    572ea4d96f213ca97ecc5dcbffe408ff2bf.exe
  • Suspicious use of AdjustPrivilegeToken
    ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2028ea4d96f213ca97ecc5dcbffe408ff2bf.exe
    Token: SeDebugPrivilege572ea4d96f213ca97ecc5dcbffe408ff2bf.exe
  • Suspicious use of WriteProcessMemory
    ea4d96f213ca97ecc5dcbffe408ff2bf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2028 wrote to memory of 2682028ea4d96f213ca97ecc5dcbffe408ff2bf.exeschtasks.exe
    PID 2028 wrote to memory of 2682028ea4d96f213ca97ecc5dcbffe408ff2bf.exeschtasks.exe
    PID 2028 wrote to memory of 2682028ea4d96f213ca97ecc5dcbffe408ff2bf.exeschtasks.exe
    PID 2028 wrote to memory of 2682028ea4d96f213ca97ecc5dcbffe408ff2bf.exeschtasks.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 2028 wrote to memory of 5722028ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\ea4d96f213ca97ecc5dcbffe408ff2bf.exe
    "C:\Users\Admin\AppData\Local\Temp\ea4d96f213ca97ecc5dcbffe408ff2bf.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OFbCwZoilYO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC82F.tmp"
      Creates scheduled task(s)
      PID:268
    • C:\Users\Admin\AppData\Local\Temp\ea4d96f213ca97ecc5dcbffe408ff2bf.exe
      "C:\Users\Admin\AppData\Local\Temp\ea4d96f213ca97ecc5dcbffe408ff2bf.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:572
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmpC82F.tmp

                        MD5

                        022f75d7c30cd36d2cdd9633a40b2ee7

                        SHA1

                        608af464fe3cae2ef0df8cac5d89bc4d04a49235

                        SHA256

                        4875882757a103b7165b7c1f9b5333e45a944f4ab219001d5cba717ff9ffac5b

                        SHA512

                        3dc5bca2d05057f3bbd7da4c8e53cbdc96d61abbc80801c29824a0501d7455485bd55e7139b30a2a58ee154543486f284c7395c192661c51654994bb6074c41f

                      • memory/268-66-0x0000000000000000-mapping.dmp

                      • memory/572-68-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/572-69-0x00000000004374BE-mapping.dmp

                      • memory/572-70-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/572-72-0x0000000004990000-0x0000000004991000-memory.dmp

                      • memory/2028-60-0x0000000000B10000-0x0000000000B11000-memory.dmp

                      • memory/2028-62-0x0000000004B30000-0x0000000004B31000-memory.dmp

                      • memory/2028-63-0x0000000000490000-0x000000000049B000-memory.dmp

                      • memory/2028-64-0x00000000054D0000-0x000000000554C000-memory.dmp

                      • memory/2028-65-0x0000000000920000-0x000000000095E000-memory.dmp