Analysis
- max time kernel
133s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 18:10
Static task
static1
Behavioral task
behavioral1
Sample
5758d2d1438dd5a76d6c6c1f4be537ca.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5758d2d1438dd5a76d6c6c1f4be537ca.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 5758d2d1438dd5a76d6c6c1f4be537ca.exe
- Size 863KB
- Sample220217-wr35kschd7
- SHA256 fb8c3859b64cab452d77c56d6ed7ebcbe49fa5ab38f1590b41ee702ff118acb9
- MD5 5758d2d1438dd5a76d6c6c1f4be537ca
- SHA1 e0ec2371f8fecb3de7ea80ffe6226e01366a6851
- SHA512 811fbc64e3b2090bff094eadac12627a17869b61c3c364480448a4602896a641f15c1ac08f55eec6d8df2a00a721d066b80f312e2863bd4659e0c098c3b8ca8b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
asus-tv.tk
-
Port
587
-
Username
-
Password
7213575aceACE@#$
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 1 IoCs
resource yara_rule behavioral2/memory/4960-140-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 5758d2d1438dd5a76d6c6c1f4be537ca.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3668 set thread context of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4960 5758d2d1438dd5a76d6c6c1f4be537ca.exe 4960 5758d2d1438dd5a76d6c6c1f4be537ca.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2180 svchost.exe Token: SeCreatePagefilePrivilege 2180 svchost.exe Token: SeShutdownPrivilege 2180 svchost.exe Token: SeCreatePagefilePrivilege 2180 svchost.exe Token: SeShutdownPrivilege 2180 svchost.exe Token: SeCreatePagefilePrivilege 2180 svchost.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe Token: SeRestorePrivilege 4900 TiWorker.exe Token: SeSecurityPrivilege 4900 TiWorker.exe Token: SeBackupPrivilege 4900 TiWorker.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3668 wrote to memory of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98 PID 3668 wrote to memory of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98 PID 3668 wrote to memory of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98 PID 3668 wrote to memory of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98 PID 3668 wrote to memory of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98 PID 3668 wrote to memory of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98 PID 3668 wrote to memory of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98 PID 3668 wrote to memory of 4960 3668 5758d2d1438dd5a76d6c6c1f4be537ca.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\5758d2d1438dd5a76d6c6c1f4be537ca.exe"C:\Users\Admin\AppData\Local\Temp\5758d2d1438dd5a76d6c6c1f4be537ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\5758d2d1438dd5a76d6c6c1f4be537ca.exe"C:\Users\Admin\AppData\Local\Temp\5758d2d1438dd5a76d6c6c1f4be537ca.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4900