Analysis
-
max time kernel
69s -
max time network
20s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-08-2021 02:18
Static task
static1
Behavioral task
behavioral1
Sample
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe
Resource
win10v20210410
General
-
Target
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe
-
Size
537KB
-
MD5
fa548af33ac073be63464186b33198aa
-
SHA1
6a49f366a9e962fca0f33d4fbd9a7bab9b076306
-
SHA256
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b
-
SHA512
47378048c422c793cffb091c782739ae34fd39788820c73c49215a6e859768c9e89d0e73f7aa7284ad5f6254add180d57c95b2a8a0b72b5f60524663eac7b962
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.tolipgoldenplaza.com - Port:
587 - Username:
[email protected] - Password:
Golden@#$2019
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/1996-63-0x00000000003A0000-0x00000000003A2000-memory.dmp coreentity -
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1636-67-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1636-68-0x000000000044C97E-mapping.dmp family_agenttesla behavioral1/memory/1636-69-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1996-64-0x0000000001F40000-0x0000000001F93000-memory.dmp rezer0 -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exedescription pid process target process PID 1996 set thread context of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exepid process 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exedescription pid process Token: SeDebugPrivilege 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe Token: SeDebugPrivilege 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exedescription pid process target process PID 1996 wrote to memory of 1524 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe schtasks.exe PID 1996 wrote to memory of 1524 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe schtasks.exe PID 1996 wrote to memory of 1524 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe schtasks.exe PID 1996 wrote to memory of 1524 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe schtasks.exe PID 1996 wrote to memory of 1616 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1616 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1616 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1616 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1996 wrote to memory of 1636 1996 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 1636 wrote to memory of 756 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe REG.exe PID 1636 wrote to memory of 756 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe REG.exe PID 1636 wrote to memory of 756 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe REG.exe PID 1636 wrote to memory of 756 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe REG.exe PID 1636 wrote to memory of 1468 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe netsh.exe PID 1636 wrote to memory of 1468 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe netsh.exe PID 1636 wrote to memory of 1468 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe netsh.exe PID 1636 wrote to memory of 1468 1636 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe"C:\Users\Admin\AppData\Local\Temp\756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFaysgfEOJsfZd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA89E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe"{path}"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA89E.tmpMD5
9dcd09e8af00561fa2121d1a22d0c6c7
SHA1b5c197f88d8e4c5cbc0efad9b05806f81d472a2c
SHA256cea1e10aee38ef58ae86e01466ae9a6f438c4e3a71c6dd28532f778a314ce52d
SHA5126b7e5990195be5382fb5381304c5651c14cff4f21acc0184adb92b9a99e5b19ea7cc9a1ca3c13f755f573042c0821732df9521cb8aaaa275b5e10293090588eb
-
memory/756-73-0x0000000000000000-mapping.dmp
-
memory/1468-74-0x0000000000000000-mapping.dmp
-
memory/1524-65-0x0000000000000000-mapping.dmp
-
memory/1636-71-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB
-
memory/1636-67-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1636-68-0x000000000044C97E-mapping.dmp
-
memory/1636-69-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1636-72-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/1636-76-0x0000000004DE1000-0x0000000004DE2000-memory.dmpFilesize
4KB
-
memory/1996-64-0x0000000001F40000-0x0000000001F93000-memory.dmpFilesize
332KB
-
memory/1996-60-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1996-63-0x00000000003A0000-0x00000000003A2000-memory.dmpFilesize
8KB
-
memory/1996-62-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB