Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 11:19
Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
PO.exe
-
Size
633KB
-
MD5
ff5d0a2b5fa45ddcdb3471236adf7b9c
-
SHA1
9d03755918f0b8c9bc7436b96c480564574bb446
-
SHA256
e352fd57db8a0670353e1c3caf02fd7d83fb315bb2e519b48dccd27eb3a2c456
-
SHA512
44bc2df5a37745b6f19cc99482d6415452736ba74ee95e3278380069cef01c8ad390a00b4a804fbf132f69abec381c76554f05d1fcc73297a2bfdfc10f9a72d1
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.ndn.edu.lb - Port:
587 - Username:
chefcomptable@ndn.edu.lb - Password:
Lebanon-Achrafieh-39
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2972-124-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2972-125-0x000000000043762E-mapping.dmp family_agenttesla -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/3128-121-0x00000000064C0000-0x00000000064CB000-memory.dmp CustAttr -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 3128 set thread context of 2972 3128 PO.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO.exeRegSvcs.exepid process 3128 PO.exe 3128 PO.exe 3128 PO.exe 2972 RegSvcs.exe 2972 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3128 PO.exe Token: SeDebugPrivilege 2972 RegSvcs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PO.exedescription pid process target process PID 3128 wrote to memory of 3064 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 3064 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 3064 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 2972 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 2972 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 2972 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 2972 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 2972 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 2972 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 2972 3128 PO.exe RegSvcs.exe PID 3128 wrote to memory of 2972 3128 PO.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2972-124-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2972-135-0x0000000005151000-0x0000000005152000-memory.dmpFilesize
4KB
-
memory/2972-132-0x0000000005DE0000-0x0000000005DE1000-memory.dmpFilesize
4KB
-
memory/2972-131-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/2972-130-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/2972-125-0x000000000043762E-mapping.dmp
-
memory/3128-118-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/3128-122-0x0000000006F50000-0x0000000006FC7000-memory.dmpFilesize
476KB
-
memory/3128-123-0x0000000006FF0000-0x000000000702E000-memory.dmpFilesize
248KB
-
memory/3128-121-0x00000000064C0000-0x00000000064CB000-memory.dmpFilesize
44KB
-
memory/3128-120-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/3128-119-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/3128-114-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/3128-117-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/3128-116-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB