Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 21:26
Static task
static1
Behavioral task
behavioral1
Sample
2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe
Resource
win10-en-20211014
General
-
Target
2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe
-
Size
493KB
-
MD5
016d9078762cb89a6043b916f3634374
-
SHA1
439da9cb1d337363ffe9c3a362480f8c2dd4edf5
-
SHA256
2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae
-
SHA512
a98052faca220bc29c374f0405a226c15b48ffac174b411b0880e5f89ee80e841e638c3e5fe15a12f5ceb03bd7b0d3543fc0dc78a0ad256bed1c343a379bba54
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.croatiahunt.com - Port:
587 - Username:
info@croatiahunt.com - Password:
VilaVrgade852
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1120-128-0x00000000004375AE-mapping.dmp family_agenttesla behavioral1/memory/1120-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\BnevyAj = "C:\\Users\\Admin\\AppData\\Roaming\\BnevyAj\\BnevyAj.exe" 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exedescription pid process target process PID 3688 set thread context of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exepid process 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 1120 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 1120 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exedescription pid process Token: SeDebugPrivilege 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe Token: SeDebugPrivilege 1120 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exedescription pid process target process PID 3688 wrote to memory of 3016 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 3016 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 3016 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe PID 3688 wrote to memory of 1120 3688 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe 2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe"C:\Users\Admin\AppData\Local\Temp\2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe"C:\Users\Admin\AppData\Local\Temp\2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe"C:\Users\Admin\AppData\Local\Temp\2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2d27046c2b2fb934bedac546cc0dcea64fd788baff5eccfcf52b430df453a6ae.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/1120-128-0x00000000004375AE-mapping.dmp
-
memory/1120-136-0x00000000064D0000-0x00000000064D1000-memory.dmpFilesize
4KB
-
memory/1120-135-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/1120-134-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/1120-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3688-122-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB
-
memory/3688-126-0x0000000001560000-0x00000000015B8000-memory.dmpFilesize
352KB
-
memory/3688-125-0x00000000012B0000-0x00000000012B1000-memory.dmpFilesize
4KB
-
memory/3688-124-0x0000000005D10000-0x0000000005D17000-memory.dmpFilesize
28KB
-
memory/3688-123-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/3688-118-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3688-121-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/3688-120-0x0000000005D20000-0x0000000005D21000-memory.dmpFilesize
4KB