Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
25-10-2021 06:26
Static task
static1
Behavioral task
behavioral1
Sample
BALS.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
BALS.exe
Resource
win10-en-20210920
General
-
Target
BALS.exe
-
Size
747KB
-
MD5
69e1838654bb9947925628e85751e075
-
SHA1
eec82ad70a06524980fa504aae5dbf641117fe93
-
SHA256
7e523a5a38f98b6a6cd3c6682699844e21d415b56ae625a1f74c914df034e06f
-
SHA512
159414d1071d169f10180f0177507c4512b57321c015dba440f86b7ef9e7cbe3300181e231d1373d254c8a18108c021af2e00fd972da39c46393b8d374628d8f
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.diniesturkiye.com - Port:
587 - Username:
[email protected] - Password:
Orhan2018
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/864-61-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/864-62-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/864-64-0x000000000043758E-mapping.dmp family_agenttesla behavioral1/memory/864-63-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BALS.exedescription pid process target process PID 1376 set thread context of 864 1376 BALS.exe BALS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
BALS.exeBALS.exedescription pid process target process PID 1376 wrote to memory of 1596 1376 BALS.exe schtasks.exe PID 1376 wrote to memory of 1596 1376 BALS.exe schtasks.exe PID 1376 wrote to memory of 1596 1376 BALS.exe schtasks.exe PID 1376 wrote to memory of 1596 1376 BALS.exe schtasks.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 1376 wrote to memory of 864 1376 BALS.exe BALS.exe PID 864 wrote to memory of 824 864 BALS.exe dw20.exe PID 864 wrote to memory of 824 864 BALS.exe dw20.exe PID 864 wrote to memory of 824 864 BALS.exe dw20.exe PID 864 wrote to memory of 824 864 BALS.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BALS.exe"C:\Users\Admin\AppData\Local\Temp\BALS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IkabgYkpvcs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8759.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\BALS.exe"C:\Users\Admin\AppData\Local\Temp\BALS.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 3963⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/824-66-0x0000000000000000-mapping.dmp
-
memory/824-69-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/864-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/864-59-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/864-60-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/864-61-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/864-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/864-64-0x000000000043758E-mapping.dmp
-
memory/864-67-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/1376-55-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/1376-57-0x0000000001F11000-0x0000000001F12000-memory.dmpFilesize
4KB
-
memory/1376-56-0x0000000001F10000-0x0000000001F11000-memory.dmpFilesize
4KB
-
memory/1596-58-0x0000000000000000-mapping.dmp