ea4d96f213ca97ecc5dcbffe408ff2bf

General
Target

ea4d96f213ca97ecc5dcbffe408ff2bf.exe

Filesize

645KB

Completed

27-07-2021 16:15

Score
10 /10
MD5

ea4d96f213ca97ecc5dcbffe408ff2bf

SHA1

3b3cbeb4060970f0d349e6ec37a20cf1285800b7

SHA256

aa49a468dd184ec1ee4b126823e7c3dec0539e75b0736b6f2a24116fc33badb9

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.privateemail.com

Port: 587

Username: max.mccanna@metaltek.me

Password: GODGRACE12345

Signatures 9

Filter: none

Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1344-126-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral2/memory/1344-127-0x00000000004374BE-mapping.dmpfamily_agenttesla
    behavioral2/memory/1344-133-0x00000000057D0000-0x0000000005CCE000-memory.dmpfamily_agenttesla
  • CustAttr .NET packer

    Description

    Detects CustAttr .NET packer in memory.

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3196-121-0x0000000004DB0000-0x0000000004DBB000-memory.dmpCustAttr
  • Suspicious use of SetThreadContext
    ea4d96f213ca97ecc5dcbffe408ff2bf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3196 set thread context of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    2196schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe

    Reported IOCs

    pidprocess
    3196ea4d96f213ca97ecc5dcbffe408ff2bf.exe
    1344ea4d96f213ca97ecc5dcbffe408ff2bf.exe
    1344ea4d96f213ca97ecc5dcbffe408ff2bf.exe
  • Suspicious use of AdjustPrivilegeToken
    ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3196ea4d96f213ca97ecc5dcbffe408ff2bf.exe
    Token: SeDebugPrivilege1344ea4d96f213ca97ecc5dcbffe408ff2bf.exe
  • Suspicious use of WriteProcessMemory
    ea4d96f213ca97ecc5dcbffe408ff2bf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3196 wrote to memory of 21963196ea4d96f213ca97ecc5dcbffe408ff2bf.exeschtasks.exe
    PID 3196 wrote to memory of 21963196ea4d96f213ca97ecc5dcbffe408ff2bf.exeschtasks.exe
    PID 3196 wrote to memory of 21963196ea4d96f213ca97ecc5dcbffe408ff2bf.exeschtasks.exe
    PID 3196 wrote to memory of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 3196 wrote to memory of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 3196 wrote to memory of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 3196 wrote to memory of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 3196 wrote to memory of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 3196 wrote to memory of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 3196 wrote to memory of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
    PID 3196 wrote to memory of 13443196ea4d96f213ca97ecc5dcbffe408ff2bf.exeea4d96f213ca97ecc5dcbffe408ff2bf.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\ea4d96f213ca97ecc5dcbffe408ff2bf.exe
    "C:\Users\Admin\AppData\Local\Temp\ea4d96f213ca97ecc5dcbffe408ff2bf.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3196
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OFbCwZoilYO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C86.tmp"
      Creates scheduled task(s)
      PID:2196
    • C:\Users\Admin\AppData\Local\Temp\ea4d96f213ca97ecc5dcbffe408ff2bf.exe
      "C:\Users\Admin\AppData\Local\Temp\ea4d96f213ca97ecc5dcbffe408ff2bf.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1344
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ea4d96f213ca97ecc5dcbffe408ff2bf.exe.log

                        MD5

                        c3cc52ccca9ff2b6fa8d267fc350ca6b

                        SHA1

                        a68d4028333296d222e4afd75dea36fdc98d05f3

                        SHA256

                        3125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e

                        SHA512

                        b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7

                      • C:\Users\Admin\AppData\Local\Temp\tmp6C86.tmp

                        MD5

                        a845f3529f8e8262cf656a43194bc1e4

                        SHA1

                        64426fbeb6c82119d8a018c3135d47003acb52de

                        SHA256

                        75130f11153b12355884fe42003042c32eaaf3717b2534e2d9f5f794604220c1

                        SHA512

                        6f8913789d3a3a9d1ff98c9e65b78b62389f00c9ace437787b5b6dccd08a15b239cf35146992347aad4abf26945e30387acc85ad218924f3205a225a2c40771d

                      • memory/1344-134-0x0000000005C80000-0x0000000005C81000-memory.dmp

                      • memory/1344-133-0x00000000057D0000-0x0000000005CCE000-memory.dmp

                      • memory/1344-127-0x00000000004374BE-mapping.dmp

                      • memory/1344-126-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/1344-135-0x0000000006530000-0x0000000006531000-memory.dmp

                      • memory/2196-124-0x0000000000000000-mapping.dmp

                      • memory/3196-123-0x0000000007020000-0x000000000705E000-memory.dmp

                      • memory/3196-122-0x0000000006F80000-0x0000000006FFC000-memory.dmp

                      • memory/3196-121-0x0000000004DB0000-0x0000000004DBB000-memory.dmp

                      • memory/3196-120-0x00000000048C0000-0x0000000004DBE000-memory.dmp

                      • memory/3196-119-0x00000000048E0000-0x00000000048E1000-memory.dmp

                      • memory/3196-118-0x0000000004A00000-0x0000000004A01000-memory.dmp

                      • memory/3196-117-0x0000000004960000-0x0000000004961000-memory.dmp

                      • memory/3196-116-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                      • memory/3196-114-0x0000000000010000-0x0000000000011000-memory.dmp