Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 20:48
Static task
static1
Behavioral task
behavioral1
Sample
Cargo details.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Cargo details.exe
Resource
win10v20210408
General
-
Target
Cargo details.exe
-
Size
937KB
-
MD5
3f40014dd3cf212056d3ea4e81f253de
-
SHA1
27be3424c54288a9ac070063f130e7e7c4c8b255
-
SHA256
84d7d4e486208acf48a9b5108034c325d3420fcd3256e0611e87fa2dda52a910
-
SHA512
bdf0fdd610b4014e844a935fdb67559b9af12fa6a05b82811b33709432f4f19f33535d90ef1b1f2071d1952d656e566acce4a4d34797e5a31387b221ff456803
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pelorusships.com - Port:
587 - Username:
maksud@pelorusships.com - Password:
Pelorusss@1230
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/764-124-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/764-125-0x000000000043764E-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Cargo details.exedescription pid process target process PID 992 set thread context of 764 992 Cargo details.exe Cargo details.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Cargo details.exepid process 764 Cargo details.exe 764 Cargo details.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Cargo details.exedescription pid process Token: SeDebugPrivilege 764 Cargo details.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Cargo details.exedescription pid process target process PID 992 wrote to memory of 764 992 Cargo details.exe Cargo details.exe PID 992 wrote to memory of 764 992 Cargo details.exe Cargo details.exe PID 992 wrote to memory of 764 992 Cargo details.exe Cargo details.exe PID 992 wrote to memory of 764 992 Cargo details.exe Cargo details.exe PID 992 wrote to memory of 764 992 Cargo details.exe Cargo details.exe PID 992 wrote to memory of 764 992 Cargo details.exe Cargo details.exe PID 992 wrote to memory of 764 992 Cargo details.exe Cargo details.exe PID 992 wrote to memory of 764 992 Cargo details.exe Cargo details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cargo details.exe"C:\Users\Admin\AppData\Local\Temp\Cargo details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cargo details.exe"C:\Users\Admin\AppData\Local\Temp\Cargo details.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Cargo details.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/764-124-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/764-133-0x0000000006110000-0x0000000006111000-memory.dmpFilesize
4KB
-
memory/764-132-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/764-131-0x0000000003060000-0x0000000003061000-memory.dmpFilesize
4KB
-
memory/764-125-0x000000000043764E-mapping.dmp
-
memory/992-118-0x0000000004B30000-0x000000000502E000-memory.dmpFilesize
5.0MB
-
memory/992-122-0x00000000068B0000-0x0000000006931000-memory.dmpFilesize
516KB
-
memory/992-123-0x00000000007F0000-0x000000000082C000-memory.dmpFilesize
240KB
-
memory/992-121-0x0000000004FC0000-0x0000000004FDB000-memory.dmpFilesize
108KB
-
memory/992-120-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/992-119-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/992-117-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/992-116-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB