Analysis
-
max time kernel
116s -
max time network
101s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-10-2021 03:17
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA COPY.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PROFORMA COPY.exe
Resource
win10-en-20211014
General
-
Target
PROFORMA COPY.exe
-
Size
338KB
-
MD5
5936715a6a40ec84592e71ccfdfc1daa
-
SHA1
380440d5690a8ed799138022a7b7678c0323c2bb
-
SHA256
3509582c5fa8e6a4cc257c72e67eec511a90790a60185bce44303fc2c39be80c
-
SHA512
d6610529fd75087bee83fc33cbc57ba1ae1ce81ab4c8e98e57b1d0b7b489cc6116db3bc6c58bc5b9c8a906d41da05305a77d90db989f0e375006fb9c42de032b
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/704-56-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/704-57-0x000000000040188B-mapping.dmp family_agenttesla behavioral1/memory/704-59-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Loads dropped DLL 1 IoCs
Processes:
PROFORMA COPY.exepid process 368 PROFORMA COPY.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PROFORMA COPY.exedescription pid process target process PID 368 set thread context of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PROFORMA COPY.exepid process 704 PROFORMA COPY.exe 704 PROFORMA COPY.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 852 dw20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PROFORMA COPY.exedescription pid process Token: SeDebugPrivilege 704 PROFORMA COPY.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PROFORMA COPY.exePROFORMA COPY.exedescription pid process target process PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 368 wrote to memory of 704 368 PROFORMA COPY.exe PROFORMA COPY.exe PID 704 wrote to memory of 852 704 PROFORMA COPY.exe dw20.exe PID 704 wrote to memory of 852 704 PROFORMA COPY.exe dw20.exe PID 704 wrote to memory of 852 704 PROFORMA COPY.exe dw20.exe PID 704 wrote to memory of 852 704 PROFORMA COPY.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA COPY.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA COPY.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA COPY.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA COPY.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5083⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsi2EFD.tmp\kivlxw.dllMD5
575dc70fae96e23a93aef3ebfdfb525b
SHA17589bbf471165323d4c0e92b8be101d95cbbeb2f
SHA256bc3cc067575a5ec3bd8fb5d1329b6f32586fd09f038fc5fafac92c2da081711e
SHA512e385b8286ffeab6252e6b99a1434b9c7526edf128e6558718add8edf0b60e24a9fc82aee34986fb517907ac966dbe7847d0115b53357f49d43c46acd1dc0a334
-
memory/368-54-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB
-
memory/704-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/704-57-0x000000000040188B-mapping.dmp
-
memory/704-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/704-61-0x0000000000321000-0x0000000000322000-memory.dmpFilesize
4KB
-
memory/704-60-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/704-63-0x0000000000327000-0x0000000000328000-memory.dmpFilesize
4KB
-
memory/704-62-0x0000000000322000-0x0000000000324000-memory.dmpFilesize
8KB
-
memory/704-64-0x0000000000328000-0x0000000000329000-memory.dmpFilesize
4KB
-
memory/852-65-0x0000000000000000-mapping.dmp
-
memory/852-67-0x0000000001ED0000-0x0000000001ED1000-memory.dmpFilesize
4KB