Analysis
-
max time kernel
145s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-07-2021 11:23
Static task
static1
Behavioral task
behavioral1
Sample
download (1).exe
Resource
win10v20210408
General
-
Target
download (1).exe
-
Size
1.3MB
-
MD5
5819570ce690a94f419bc55388fbe380
-
SHA1
4c9fef3a3293aa038ee09c934911e2ba1923ee7d
-
SHA256
1d41fc65447b81c51361cb610956897beb82f059249e29bc1f47ae2fd0e1218a
-
SHA512
160cee8b7006c69441acff77ba77b2fbb295c005bf924654858192e063a6f8f57c391f528585d0cfb62aef16a991d8ec36f5380f6339a1cb6c8eac416d288c75
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
quutsuozucrxskyo
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3992-125-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/3992-126-0x00000000004375EE-mapping.dmp family_agenttesla -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/808-122-0x0000000005470000-0x000000000547B000-memory.dmp CustAttr -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
download (1).exedescription pid process target process PID 808 set thread context of 3992 808 download (1).exe download (1).exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
download (1).exepid process 3992 download (1).exe 3992 download (1).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
download (1).exedescription pid process Token: SeDebugPrivilege 3992 download (1).exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
download (1).exedescription pid process target process PID 808 wrote to memory of 3992 808 download (1).exe download (1).exe PID 808 wrote to memory of 3992 808 download (1).exe download (1).exe PID 808 wrote to memory of 3992 808 download (1).exe download (1).exe PID 808 wrote to memory of 3992 808 download (1).exe download (1).exe PID 808 wrote to memory of 3992 808 download (1).exe download (1).exe PID 808 wrote to memory of 3992 808 download (1).exe download (1).exe PID 808 wrote to memory of 3992 808 download (1).exe download (1).exe PID 808 wrote to memory of 3992 808 download (1).exe download (1).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\download (1).exe"C:\Users\Admin\AppData\Local\Temp\download (1).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\download (1).exe"C:\Users\Admin\AppData\Local\Temp\download (1).exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/808-114-0x00000000006B0000-0x00000000006B1000-memory.dmpFilesize
4KB
-
memory/808-116-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/808-117-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/808-118-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/808-119-0x00000000051E0000-0x00000000056DE000-memory.dmpFilesize
5.0MB
-
memory/808-120-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/808-121-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/808-122-0x0000000005470000-0x000000000547B000-memory.dmpFilesize
44KB
-
memory/808-123-0x00000000079D0000-0x0000000007A52000-memory.dmpFilesize
520KB
-
memory/808-124-0x0000000007A60000-0x0000000007A9D000-memory.dmpFilesize
244KB
-
memory/3992-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3992-126-0x00000000004375EE-mapping.dmp
-
memory/3992-131-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/3992-132-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/3992-133-0x0000000005C10000-0x0000000005C11000-memory.dmpFilesize
4KB
-
memory/3992-136-0x0000000004EE1000-0x0000000004EE2000-memory.dmpFilesize
4KB