Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
22-10-2021 06:34
Static task
static1
Behavioral task
behavioral1
Sample
POIM101385.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
POIM101385.exe
Resource
win10-en-20210920
General
-
Target
POIM101385.exe
-
Size
453KB
-
MD5
f1e3f54edbeffd5786fb49487872f2e3
-
SHA1
22418d61c9a779f6a1e651928ba86b36755abd78
-
SHA256
e66ed8d87430588f029d4ed6787d54de508b271fca3d2266023ae1f0c69d75e2
-
SHA512
c8a029af97c5ded5cb3aaccba31b6f0753d6a92c49c93f22e1cc20061ec2a29fd2d033b643e1fa4ea1f39f3cb1a9fa4980aae078c9a510e717ec294a260316a1
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/456-57-0x0000000000400000-0x000000000044B000-memory.dmp family_agenttesla behavioral1/memory/456-58-0x000000000040188B-mapping.dmp family_agenttesla behavioral1/memory/456-60-0x0000000000400000-0x000000000044B000-memory.dmp family_agenttesla -
Loads dropped DLL 1 IoCs
Processes:
POIM101385.exepid process 1088 POIM101385.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
POIM101385.exedescription pid process target process PID 1088 set thread context of 456 1088 POIM101385.exe POIM101385.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
POIM101385.exepid process 456 POIM101385.exe 456 POIM101385.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 620 dw20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
POIM101385.exedescription pid process Token: SeDebugPrivilege 456 POIM101385.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
POIM101385.exePOIM101385.exedescription pid process target process PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 1088 wrote to memory of 456 1088 POIM101385.exe POIM101385.exe PID 456 wrote to memory of 620 456 POIM101385.exe dw20.exe PID 456 wrote to memory of 620 456 POIM101385.exe dw20.exe PID 456 wrote to memory of 620 456 POIM101385.exe dw20.exe PID 456 wrote to memory of 620 456 POIM101385.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\POIM101385.exe"C:\Users\Admin\AppData\Local\Temp\POIM101385.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\POIM101385.exe"C:\Users\Admin\AppData\Local\Temp\POIM101385.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5083⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsoEADD.tmp\cxapxirycmq.dllMD5
f9c99f7e3b80bd0757ccad6a4ee2c795
SHA1e487ee3c5fc3d1e0817a8c5646ed042312a8ad83
SHA256963d2beb680b2f7b490063c3f248ae28fdadec39b0b9542c4b79a48f07bbd907
SHA512c4ed2f2dc2b6d79f3f37433023428bfe7607360e257864e29fab249619e666df5b00542640d89f29ae510f83e514b41eba14fcc3232e9416a0b8e248eb59b01c
-
memory/456-57-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/456-58-0x000000000040188B-mapping.dmp
-
memory/456-60-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/456-62-0x0000000001ED1000-0x0000000001ED2000-memory.dmpFilesize
4KB
-
memory/456-61-0x0000000001ED0000-0x0000000001ED1000-memory.dmpFilesize
4KB
-
memory/456-64-0x0000000001ED7000-0x0000000001ED8000-memory.dmpFilesize
4KB
-
memory/456-63-0x0000000001ED2000-0x0000000001ED4000-memory.dmpFilesize
8KB
-
memory/456-65-0x0000000001ED8000-0x0000000001ED9000-memory.dmpFilesize
4KB
-
memory/620-66-0x0000000000000000-mapping.dmp
-
memory/620-68-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/1088-55-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB