Analysis
- max time kernel
139s - max time network
112s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/08/2021, 19:27
General
- Target SHIPPING ADV304454.exe
- Size 1.4MB
- Sample210802-yy2cwpbkke
- SHA256 44a055181a37d0324dad0868ad50bb92ae843d3f0967be5dfa97704577a08e50
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.bsia.co.in
-
Port
587
-
Username
-
Password
21mbsia@)@!Y
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING ADV304454.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/632-121-0x0000000004D60000-0x0000000004D6D000-memory.dmp
memory/632-117-0x0000000005300000-0x0000000005301000-memory.dmp
memory/632-118-0x0000000005260000-0x000000000575E000-memory.dmp
memory/632-119-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/632-120-0x0000000005C60000-0x0000000005C61000-memory.dmp
memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmp
memory/632-122-0x000000000B510000-0x000000000B5A5000-memory.dmp
memory/632-123-0x0000000008020000-0x0000000008057000-memory.dmp
memory/632-116-0x0000000005760000-0x0000000005761000-memory.dmp
memory/2108-377-0x0000000005760000-0x0000000005761000-memory.dmp
memory/2108-125-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2108-142-0x0000000005340000-0x000000000583E000-memory.dmp
memory/3680-137-0x0000000006FC0000-0x0000000006FC1000-memory.dmp
memory/3680-144-0x0000000008090000-0x0000000008091000-memory.dmp
memory/3680-134-0x0000000007060000-0x0000000007061000-memory.dmp
memory/3680-138-0x0000000007870000-0x0000000007871000-memory.dmp
memory/3680-139-0x00000000078F0000-0x00000000078F1000-memory.dmp
memory/3680-140-0x0000000004680000-0x0000000004681000-memory.dmp
memory/3680-132-0x00000000044D0000-0x00000000044D1000-memory.dmp
memory/3680-141-0x0000000004682000-0x0000000004683000-memory.dmp
memory/3680-143-0x00000000077C0000-0x00000000077C1000-memory.dmp
memory/3680-136-0x0000000006EA0000-0x0000000006EA1000-memory.dmp
memory/3680-145-0x0000000007FB0000-0x0000000007FB1000-memory.dmp
memory/3680-153-0x0000000008D80000-0x0000000008DB3000-memory.dmp
memory/3680-160-0x0000000008D60000-0x0000000008D61000-memory.dmp
memory/3680-165-0x0000000008DD0000-0x0000000008DD1000-memory.dmp
memory/3680-166-0x0000000009290000-0x0000000009291000-memory.dmp
memory/3680-233-0x000000007EFB0000-0x000000007EFB1000-memory.dmp
memory/3680-234-0x0000000004683000-0x0000000004684000-memory.dmp
memory/3680-361-0x0000000009240000-0x0000000009241000-memory.dmp
memory/3680-367-0x0000000009230000-0x0000000009231000-memory.dmp