Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 14:12
Static task
static1
Behavioral task
behavioral1
Sample
PO 98246.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PO 98246.exe
Resource
win10v20210410
General
-
Target
PO 98246.exe
-
Size
940KB
-
MD5
87fb6b88ed5e0ad768dd1fb8fc9c46af
-
SHA1
739749390782129616a8a776ff745a748de3048a
-
SHA256
9cb1e7f66fe3c5e0ba2e1d525dddf593ceb57df41a49b874228c61322e6a4861
-
SHA512
e3c4177f3de2aecb953b0f6efed90d969e9a3d4254985ad4ae58a917554961164321570fcf83ae8e5d95c6c5f9fc008ce2c241faaad28c9b01bbc3f82d081ef5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
paola.micheli@copangroup.xyz - Password:
gibson.1990
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3828-124-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/3828-125-0x000000000043760E-mapping.dmp family_agenttesla behavioral2/memory/3828-131-0x0000000005870000-0x0000000005D6E000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
PO 98246.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts PO 98246.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PO 98246.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe" PO 98246.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 98246.exedescription pid process target process PID 2256 set thread context of 3828 2256 PO 98246.exe PO 98246.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
PO 98246.exePO 98246.exepid process 2256 PO 98246.exe 2256 PO 98246.exe 3828 PO 98246.exe 3828 PO 98246.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO 98246.exePO 98246.exedescription pid process Token: SeDebugPrivilege 2256 PO 98246.exe Token: SeDebugPrivilege 3828 PO 98246.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PO 98246.exedescription pid process target process PID 2256 wrote to memory of 3764 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3764 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3764 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3828 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3828 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3828 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3828 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3828 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3828 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3828 2256 PO 98246.exe PO 98246.exe PID 2256 wrote to memory of 3828 2256 PO 98246.exe PO 98246.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"C:\Users\Admin\AppData\Local\Temp\PO 98246.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO 98246.exe.logMD5
a8225268a0cfd23e60750624c7fe5113
SHA192567d25c5ef4fc85c9dda60a0625e0bb9c72d97
SHA2562d820f6fb6c206a25e346f653150ae314d58de33c4e15ac600e7618093ac2261
SHA5128f7ecc25006b79173ae9fdca2843a315df5aa259882953e4864aafefcb8ca62c0d0a4f16baf2f0fdc3b0a8235bd63fdb345f991e9d5c5cce290a0ef032ce2ef1
-
memory/2256-123-0x00000000055A0000-0x00000000055AF000-memory.dmpFilesize
60KB
-
memory/2256-116-0x0000000005A30000-0x0000000005A31000-memory.dmpFilesize
4KB
-
memory/2256-118-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/2256-119-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/2256-120-0x0000000005380000-0x0000000005412000-memory.dmpFilesize
584KB
-
memory/2256-121-0x0000000005530000-0x0000000005598000-memory.dmpFilesize
416KB
-
memory/2256-117-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/2256-114-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/2256-122-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/3828-125-0x000000000043760E-mapping.dmp
-
memory/3828-124-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3828-131-0x0000000005870000-0x0000000005D6E000-memory.dmpFilesize
5.0MB
-
memory/3828-132-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/3828-133-0x00000000064D0000-0x00000000064D1000-memory.dmpFilesize
4KB
-
memory/3828-135-0x0000000006460000-0x0000000006461000-memory.dmpFilesize
4KB