Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    24-10-2021 11:28

General

  • Target

    SIGN_AND.EXE

  • Size

    717KB

  • MD5

    4cc0def143dc2acc2bf653dc3d69f1c5

  • SHA1

    20a739bf4278016e0ee4563685e0cd3d8521aa2d

  • SHA256

    271170cb7b83cb6365facd500c213e5cd2efb157288fd58281ec84d19a6f357a

  • SHA512

    68e5cbb9847e7a1f4991aca0693130ee937ad704acbfc16d33b12035d88fae797151bb815165019e4b8342ec33ed8085b5c99b8e5b023f3384d700771be53a70

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.bulletproofprotections.com
  • Port:
    587
  • Username:
    account@bulletproofprotections.com
  • Password:
    Everest10account

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE
    "C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE
      "C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE"
      2⤵
        PID:1412

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1412-57-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1412-58-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1412-59-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1412-60-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1412-61-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1412-62-0x000000000043779E-mapping.dmp
    • memory/1412-64-0x0000000002000000-0x0000000002001000-memory.dmp
      Filesize

      4KB

    • memory/1612-54-0x00000000751A1000-0x00000000751A3000-memory.dmp
      Filesize

      8KB

    • memory/1612-55-0x0000000002000000-0x0000000002001000-memory.dmp
      Filesize

      4KB

    • memory/1612-56-0x0000000002001000-0x0000000002002000-memory.dmp
      Filesize

      4KB