Analysis
-
max time kernel
123s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 13:08
Static task
static1
Behavioral task
behavioral1
Sample
USD 58,508.80.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
USD 58,508.80.exe
Resource
win10-en-20211014
General
-
Target
USD 58,508.80.exe
-
Size
430KB
-
MD5
99c99ae716fba538d8685f2e9d5f9be5
-
SHA1
4aac17819f8dc6a9435481fda825936c47aeb489
-
SHA256
9dc6644b59a4c37995b0c017256d938e03f6dc26a7b2cfee9f6eac92d8457dc6
-
SHA512
aafd92aae54543999bc54cc9f3ab1126a52c5d91e4bbca17c9bf07d36132c84c1b76e945d1ce3ccd5dcecb1d187a225ed85423ab0338ccbc7dc016a9ed1e6750
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1328-57-0x0000000000400000-0x000000000044B000-memory.dmp family_agenttesla behavioral1/memory/1328-58-0x000000000040188B-mapping.dmp family_agenttesla behavioral1/memory/1328-60-0x0000000000400000-0x000000000044B000-memory.dmp family_agenttesla -
Loads dropped DLL 1 IoCs
Processes:
USD 58,508.80.exepid process 1876 USD 58,508.80.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
USD 58,508.80.exedescription pid process target process PID 1876 set thread context of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
USD 58,508.80.exepid process 1328 USD 58,508.80.exe 1328 USD 58,508.80.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 804 dw20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
USD 58,508.80.exedescription pid process Token: SeDebugPrivilege 1328 USD 58,508.80.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
USD 58,508.80.exeUSD 58,508.80.exedescription pid process target process PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1876 wrote to memory of 1328 1876 USD 58,508.80.exe USD 58,508.80.exe PID 1328 wrote to memory of 804 1328 USD 58,508.80.exe dw20.exe PID 1328 wrote to memory of 804 1328 USD 58,508.80.exe dw20.exe PID 1328 wrote to memory of 804 1328 USD 58,508.80.exe dw20.exe PID 1328 wrote to memory of 804 1328 USD 58,508.80.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\USD 58,508.80.exe"C:\Users\Admin\AppData\Local\Temp\USD 58,508.80.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\USD 58,508.80.exe"C:\Users\Admin\AppData\Local\Temp\USD 58,508.80.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5083⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsdC488.tmp\woskyvpzx.dllMD5
dd4ff4b24f8b39951e3946a5282b7ed0
SHA1d4d1015d01326ba4526fcff52e4c9bbb271d951e
SHA256f880d09a6f9bc64f974844f92fa9bb764dc2613342fde134d8c037a2267506bc
SHA5126e822b523f15948a42b1d2703525c8f3744fbb6a7e3aff99345908822fbd65dafe38d6972976211f9558c712d65be1c1a42bb9dabb63fb4576c409ce95e93528
-
memory/804-66-0x0000000000000000-mapping.dmp
-
memory/804-68-0x0000000002400000-0x0000000002456000-memory.dmpFilesize
344KB
-
memory/1328-57-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1328-58-0x000000000040188B-mapping.dmp
-
memory/1328-60-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1328-61-0x0000000001E00000-0x0000000001E01000-memory.dmpFilesize
4KB
-
memory/1328-63-0x0000000001E02000-0x0000000001E04000-memory.dmpFilesize
8KB
-
memory/1328-62-0x0000000001E01000-0x0000000001E02000-memory.dmpFilesize
4KB
-
memory/1328-64-0x0000000001E07000-0x0000000001E08000-memory.dmpFilesize
4KB
-
memory/1328-65-0x0000000001E08000-0x0000000001E09000-memory.dmpFilesize
4KB
-
memory/1876-55-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB