Analysis
- max time kernel
179s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
PO #30114.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO #30114.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target PO #30114.exe
- Size 121KB
- Sample220208-kep7eaehal
- SHA256 64613e9558bf51f7c56f7e3f7a7d770e87859e8a8bac31a67c6dab53c59d53d5
- MD5 294b7c06479a50f7d4b187299d159747
- SHA1 cbb621c5a8d2cf07901105835d4cab34a5cdef3f
- SHA512 34c2ae855dab03467e309ed6f4623ee53ba8e8468b45b85240ec2f3c3f4a80e258f6fcb7addcb44d92ee80dbce42f8b1c92f18e4e4342897eb321982fa588798
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.bhgautopartes.com
-
Port
587
-
Username
-
Password
icui4cu2@@
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 1 IoCs
resource yara_rule behavioral2/memory/3708-141-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4388 set thread context of 3708 4388 PO #30114.exe 98 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4388 PO #30114.exe 4388 PO #30114.exe 3708 MSBuild.exe 3708 MSBuild.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1148 svchost.exe Token: SeCreatePagefilePrivilege 1148 svchost.exe Token: SeShutdownPrivilege 1148 svchost.exe Token: SeCreatePagefilePrivilege 1148 svchost.exe Token: SeShutdownPrivilege 1148 svchost.exe Token: SeCreatePagefilePrivilege 1148 svchost.exe Token: SeDebugPrivilege 4388 PO #30114.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe Token: SeBackupPrivilege 4496 TiWorker.exe Token: SeRestorePrivilege 4496 TiWorker.exe Token: SeSecurityPrivilege 4496 TiWorker.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4388 wrote to memory of 3708 4388 PO #30114.exe 98 PID 4388 wrote to memory of 3708 4388 PO #30114.exe 98 PID 4388 wrote to memory of 3708 4388 PO #30114.exe 98 PID 4388 wrote to memory of 3708 4388 PO #30114.exe 98 PID 4388 wrote to memory of 3708 4388 PO #30114.exe 98 PID 4388 wrote to memory of 3708 4388 PO #30114.exe 98 PID 4388 wrote to memory of 3708 4388 PO #30114.exe 98 PID 4388 wrote to memory of 3708 4388 PO #30114.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO #30114.exe"C:\Users\Admin\AppData\Local\Temp\PO #30114.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4496