Analysis
-
max time kernel
117s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
25-10-2021 06:26
Static task
static1
Behavioral task
behavioral1
Sample
BALS.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
BALS.exe
Resource
win10-en-20210920
General
-
Target
BALS.exe
-
Size
747KB
-
MD5
69e1838654bb9947925628e85751e075
-
SHA1
eec82ad70a06524980fa504aae5dbf641117fe93
-
SHA256
7e523a5a38f98b6a6cd3c6682699844e21d415b56ae625a1f74c914df034e06f
-
SHA512
159414d1071d169f10180f0177507c4512b57321c015dba440f86b7ef9e7cbe3300181e231d1373d254c8a18108c021af2e00fd972da39c46393b8d374628d8f
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.diniesturkiye.com - Port:
587 - Username:
[email protected] - Password:
Orhan2018
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3476-117-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/3476-118-0x000000000043758E-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BALS.exedescription pid process target process PID 760 set thread context of 3476 760 BALS.exe BALS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BALS.exedw20.exepid process 760 BALS.exe 760 BALS.exe 4196 dw20.exe 4196 dw20.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
BALS.exedw20.exedescription pid process Token: SeDebugPrivilege 760 BALS.exe Token: SeRestorePrivilege 4196 dw20.exe Token: SeBackupPrivilege 4196 dw20.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
BALS.exeBALS.exedescription pid process target process PID 760 wrote to memory of 4476 760 BALS.exe schtasks.exe PID 760 wrote to memory of 4476 760 BALS.exe schtasks.exe PID 760 wrote to memory of 4476 760 BALS.exe schtasks.exe PID 760 wrote to memory of 3872 760 BALS.exe BALS.exe PID 760 wrote to memory of 3872 760 BALS.exe BALS.exe PID 760 wrote to memory of 3872 760 BALS.exe BALS.exe PID 760 wrote to memory of 3476 760 BALS.exe BALS.exe PID 760 wrote to memory of 3476 760 BALS.exe BALS.exe PID 760 wrote to memory of 3476 760 BALS.exe BALS.exe PID 760 wrote to memory of 3476 760 BALS.exe BALS.exe PID 760 wrote to memory of 3476 760 BALS.exe BALS.exe PID 760 wrote to memory of 3476 760 BALS.exe BALS.exe PID 760 wrote to memory of 3476 760 BALS.exe BALS.exe PID 760 wrote to memory of 3476 760 BALS.exe BALS.exe PID 3476 wrote to memory of 4196 3476 BALS.exe dw20.exe PID 3476 wrote to memory of 4196 3476 BALS.exe dw20.exe PID 3476 wrote to memory of 4196 3476 BALS.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BALS.exe"C:\Users\Admin\AppData\Local\Temp\BALS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IkabgYkpvcs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp560B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\BALS.exe"C:\Users\Admin\AppData\Local\Temp\BALS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BALS.exe"C:\Users\Admin\AppData\Local\Temp\BALS.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7043⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\BALS.exe.logMD5
ef140ef600b2463c9e7dbf064a104046
SHA1c08fd1853877be95575ea2e860dd8cafef31f54c
SHA256ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616
SHA512bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c
-
memory/760-115-0x00000000017F0000-0x00000000017F1000-memory.dmpFilesize
4KB
-
memory/3476-117-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3476-118-0x000000000043758E-mapping.dmp
-
memory/3476-121-0x00000000029E0000-0x00000000029E1000-memory.dmpFilesize
4KB
-
memory/4196-120-0x0000000000000000-mapping.dmp
-
memory/4476-116-0x0000000000000000-mapping.dmp