Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-04-2022 05:37
Static task
static1
Behavioral task
behavioral1
Sample
59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe
-
Size
1.1MB
-
MD5
5502aebf11a2026d20a4327f1e5c3fd4
-
SHA1
ff7d9a61698caada9d59bc797a9f460be1d1f73f
-
SHA256
59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c
-
SHA512
48a960172ff19bb1b26854ca1ee9883f929e0dbcc165d3224bf1cd332d9eea7052d12a673371dcfc9846f642617a826f03be039f7af699c10ded71d0fb4c8f6a
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.mentonv.com - Port:
587 - Username:
[email protected] - Password:
monni@2419
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
-
AgentTesla Payload 1 IoCs
resource yara_rule behavioral1/memory/1620-58-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1836 set thread context of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 872 set thread context of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1620 RegAsm.exe 1620 RegAsm.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1688 RegAsm.exe 1688 RegAsm.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1620 RegAsm.exe Token: SeDebugPrivilege 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe Token: SeDebugPrivilege 1688 RegAsm.exe Token: SeDebugPrivilege 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 1836 wrote to memory of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 1836 wrote to memory of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 1836 wrote to memory of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 1836 wrote to memory of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 1836 wrote to memory of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 1836 wrote to memory of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 1836 wrote to memory of 1620 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 28 PID 1836 wrote to memory of 872 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 29 PID 1836 wrote to memory of 872 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 29 PID 1836 wrote to memory of 872 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 29 PID 1836 wrote to memory of 872 1836 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 29 PID 872 wrote to memory of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30 PID 872 wrote to memory of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30 PID 872 wrote to memory of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30 PID 872 wrote to memory of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30 PID 872 wrote to memory of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30 PID 872 wrote to memory of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30 PID 872 wrote to memory of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30 PID 872 wrote to memory of 1688 872 59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe"C:\Users\Admin\AppData\Local\Temp\59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Users\Admin\AppData\Local\Temp\59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe"C:\Users\Admin\AppData\Local\Temp\59c8f09bbe3cdf443db7ab7746d97bd00b894dbb955a82fc3a10e2ac3b8ee56c.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-