Analysis
-
max time kernel
60s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
04-08-2021 02:18
Static task
static1
Behavioral task
behavioral1
Sample
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe
Resource
win10v20210410
General
-
Target
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe
-
Size
537KB
-
MD5
fa548af33ac073be63464186b33198aa
-
SHA1
6a49f366a9e962fca0f33d4fbd9a7bab9b076306
-
SHA256
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b
-
SHA512
47378048c422c793cffb091c782739ae34fd39788820c73c49215a6e859768c9e89d0e73f7aa7284ad5f6254add180d57c95b2a8a0b72b5f60524663eac7b962
Malware Config
Extracted
Protocol: smtp- Host:
mail.tolipgoldenplaza.com - Port:
587 - Username:
[email protected] - Password:
Golden@#$2019
Extracted
agenttesla
Protocol: smtp- Host:
mail.tolipgoldenplaza.com - Port:
587 - Username:
[email protected] - Password:
Golden@#$2019
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral2/memory/4024-120-0x0000000004E00000-0x0000000004E02000-memory.dmp coreentity -
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2868-125-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral2/memory/2868-126-0x000000000044C97E-mapping.dmp family_agenttesla -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral2/memory/4024-122-0x0000000006C50000-0x0000000006CA3000-memory.dmp rezer0 -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exedescription pid process target process PID 4024 set thread context of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exepid process 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exedescription pid process Token: SeDebugPrivilege 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe Token: SeDebugPrivilege 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exedescription pid process target process PID 4024 wrote to memory of 2412 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe schtasks.exe PID 4024 wrote to memory of 2412 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe schtasks.exe PID 4024 wrote to memory of 2412 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe schtasks.exe PID 4024 wrote to memory of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 4024 wrote to memory of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 4024 wrote to memory of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 4024 wrote to memory of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 4024 wrote to memory of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 4024 wrote to memory of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 4024 wrote to memory of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 4024 wrote to memory of 2868 4024 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe PID 2868 wrote to memory of 2620 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe REG.exe PID 2868 wrote to memory of 2620 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe REG.exe PID 2868 wrote to memory of 2620 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe REG.exe PID 2868 wrote to memory of 732 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe netsh.exe PID 2868 wrote to memory of 732 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe netsh.exe PID 2868 wrote to memory of 732 2868 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe"C:\Users\Admin\AppData\Local\Temp\756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFaysgfEOJsfZd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2521.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b.exe"{path}"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2521.tmpMD5
978815f2a5428138446d10a0ec753613
SHA176b64cb97c36231ca0fe40b2d653239d635d5239
SHA2565dc7a8b2414df8975f6708d8f31819f1800cabb1e1021813aab4ca4f59be8cec
SHA5127f11a3ef6f559cc2a1a40d15c3acdb9a386651e02932ed79fc2482c67f11e169304ccd9c6b92258ffc07067e02559c204b50b983ae50b0aecad43e21aaa3b80a
-
memory/732-135-0x0000000000000000-mapping.dmp
-
memory/2412-123-0x0000000000000000-mapping.dmp
-
memory/2620-134-0x0000000000000000-mapping.dmp
-
memory/2868-131-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/2868-133-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/2868-138-0x0000000004EE1000-0x0000000004EE2000-memory.dmpFilesize
4KB
-
memory/2868-132-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/2868-126-0x000000000044C97E-mapping.dmp
-
memory/2868-125-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4024-118-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/4024-119-0x0000000006AB0000-0x0000000006AB1000-memory.dmpFilesize
4KB
-
memory/4024-114-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/4024-122-0x0000000006C50000-0x0000000006CA3000-memory.dmpFilesize
332KB
-
memory/4024-120-0x0000000004E00000-0x0000000004E02000-memory.dmpFilesize
8KB
-
memory/4024-117-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/4024-116-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/4024-121-0x0000000004A40000-0x0000000004F3E000-memory.dmpFilesize
5.0MB