Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
20-10-2021 09:40
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe
Resource
win10-en-20211014
General
-
Target
INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe
-
Size
681KB
-
MD5
422343b5ffbc0b2c7d47abfba7c24172
-
SHA1
33ea66969c89ede393e4685a5a580d2b24d49242
-
SHA256
174bde453acb124cf771fc3420cf4e12267bbef9bedb36d81a51988dc44c0875
-
SHA512
10249c86f4b867c8d167906d84a79a965a99cba19a257cfa7be9f00a4304ff3984bb512c7a6dd1c67ac8a2cf8d223754d916ac17c806403b1050bb6030ed684b
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.grodno.by - Port:
587 - Username:
[email protected] - Password:
9qd8$2NonPD
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1524-60-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1524-61-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1524-62-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1524-63-0x00000000004374AE-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exedescription pid process target process PID 1776 set thread context of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exepid process 1524 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe 1524 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 932 dw20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exedescription pid process Token: SeDebugPrivilege 1524 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exeINQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exedescription pid process target process PID 1776 wrote to memory of 652 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe schtasks.exe PID 1776 wrote to memory of 652 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe schtasks.exe PID 1776 wrote to memory of 652 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe schtasks.exe PID 1776 wrote to memory of 652 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe schtasks.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1776 wrote to memory of 1524 1776 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe PID 1524 wrote to memory of 932 1524 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe dw20.exe PID 1524 wrote to memory of 932 1524 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe dw20.exe PID 1524 wrote to memory of 932 1524 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe dw20.exe PID 1524 wrote to memory of 932 1524 INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eBctLC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4653.tmp"2⤵
- Creates scheduled task(s)
PID:652 -
C:\Users\Admin\AppData\Local\Temp\INQUIRY FOR NEW QUOTATION FOR SAPA TRADING.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5203⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:932
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4653.tmpMD5
1363787f8e637dd3d45d96cd490efd53
SHA1d7f4d166cf9ce0a6e61cca078a4497a21f21ea0e
SHA256ecabda2ff4416ff7c6ffaa941d4457c51657d33548603f06f8024cb386c2d449
SHA512daa7a2de38e6df1831c04946f21e16d2ad506cc41df9a29a855435edad86602bfc29c4a79d7e80ae0d7581be6d601ed67226c19d18e4fcb8dc5d31c1826bbb35
-
memory/652-56-0x0000000000000000-mapping.dmp
-
memory/932-68-0x0000000001C10000-0x0000000001C11000-memory.dmpFilesize
4KB
-
memory/932-66-0x0000000000000000-mapping.dmp
-
memory/1524-59-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1524-58-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1524-60-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1524-61-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1524-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1524-63-0x00000000004374AE-mapping.dmp
-
memory/1524-65-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1776-53-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1776-55-0x0000000000671000-0x0000000000672000-memory.dmpFilesize
4KB
-
memory/1776-54-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB