Analysis
-
max time kernel
149s -
max time network
42s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 20:48
Static task
static1
Behavioral task
behavioral1
Sample
Cargo details.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Cargo details.exe
Resource
win10v20210408
General
-
Target
Cargo details.exe
-
Size
937KB
-
MD5
3f40014dd3cf212056d3ea4e81f253de
-
SHA1
27be3424c54288a9ac070063f130e7e7c4c8b255
-
SHA256
84d7d4e486208acf48a9b5108034c325d3420fcd3256e0611e87fa2dda52a910
-
SHA512
bdf0fdd610b4014e844a935fdb67559b9af12fa6a05b82811b33709432f4f19f33535d90ef1b1f2071d1952d656e566acce4a4d34797e5a31387b221ff456803
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pelorusships.com - Port:
587 - Username:
maksud@pelorusships.com - Password:
Pelorusss@1230
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/268-66-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/268-67-0x000000000043764E-mapping.dmp family_agenttesla behavioral1/memory/268-68-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Cargo details.exedescription pid process target process PID 1652 set thread context of 268 1652 Cargo details.exe Cargo details.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Cargo details.exepid process 268 Cargo details.exe 268 Cargo details.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Cargo details.exedescription pid process Token: SeDebugPrivilege 268 Cargo details.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Cargo details.exepid process 268 Cargo details.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Cargo details.exedescription pid process target process PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe PID 1652 wrote to memory of 268 1652 Cargo details.exe Cargo details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cargo details.exe"C:\Users\Admin\AppData\Local\Temp\Cargo details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cargo details.exe"C:\Users\Admin\AppData\Local\Temp\Cargo details.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-66-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/268-67-0x000000000043764E-mapping.dmp
-
memory/268-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/268-70-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/268-71-0x0000000004801000-0x0000000004802000-memory.dmpFilesize
4KB
-
memory/1652-60-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1652-62-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/1652-63-0x00000000006F0000-0x000000000070B000-memory.dmpFilesize
108KB
-
memory/1652-64-0x0000000007F10000-0x0000000007F91000-memory.dmpFilesize
516KB
-
memory/1652-65-0x0000000004A80000-0x0000000004ABC000-memory.dmpFilesize
240KB