Analysis
-
max time kernel
125s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:51
Static task
static1
Behavioral task
behavioral1
Sample
PO#2207020 p2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO#2207020 p2.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
PO#2207020.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
PO#2207020.exe
Resource
win10v2004-20220414-en
General
-
Target
PO#2207020.exe
-
Size
476KB
-
MD5
ce5c25d462cbef99251c3a8984f9fbdc
-
SHA1
0bf44e4fb8764de6480d5a18c98c668d55da00f9
-
SHA256
018655556fe0544b51a8c4ed1a6a4e3845a6acfe8635fb4b7f304d6f4f845d8b
-
SHA512
47c15c543654dc493bc2fbc4a2752ab071b50282689e8f4135fcfbb72e48848c190300f5473c63c7c13bd87a3957a5c746fad48dacfaaf49a96ba1823854a742
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.aylaalgan.com.tr - Port:
587 - Username:
[email protected] - Password:
20162016
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral3/memory/1736-63-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral3/memory/1736-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral3/memory/1736-65-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral3/memory/1736-66-0x00000000004470CE-mapping.dmp family_agenttesla behavioral3/memory/1736-70-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral3/memory/1736-68-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO#2207020.exedescription pid process target process PID 1732 set thread context of 1736 1732 PO#2207020.exe PO#2207020.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO#2207020.exePO#2207020.exepid process 1732 PO#2207020.exe 1732 PO#2207020.exe 1732 PO#2207020.exe 1736 PO#2207020.exe 1736 PO#2207020.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO#2207020.exePO#2207020.exedescription pid process Token: SeDebugPrivilege 1732 PO#2207020.exe Token: SeDebugPrivilege 1736 PO#2207020.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
PO#2207020.exedescription pid process target process PID 1732 wrote to memory of 1328 1732 PO#2207020.exe schtasks.exe PID 1732 wrote to memory of 1328 1732 PO#2207020.exe schtasks.exe PID 1732 wrote to memory of 1328 1732 PO#2207020.exe schtasks.exe PID 1732 wrote to memory of 1328 1732 PO#2207020.exe schtasks.exe PID 1732 wrote to memory of 936 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 936 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 936 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 936 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1620 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1620 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1620 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1620 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1612 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1612 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1612 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1612 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe PID 1732 wrote to memory of 1736 1732 PO#2207020.exe PO#2207020.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#2207020.exe"C:\Users\Admin\AppData\Local\Temp\PO#2207020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JDIsEUpyS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD72.tmp"2⤵
- Creates scheduled task(s)
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\PO#2207020.exe"{path}"2⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\PO#2207020.exe"{path}"2⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\PO#2207020.exe"{path}"2⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\PO#2207020.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFD72.tmpFilesize
1KB
MD56ed63a98825c7d9b18abbf4b2120fe6d
SHA14012a42c3a6af502c892ee2b70aa4e74bf31424e
SHA256360deee8ce8a5c90e6a1b7705416e4f95fd745903b679ae81bcb03f7eda4b017
SHA512fa6fba8ad8449a23e15e4f1cea080e7ddb67acbcb6ee0616824a4f262a815dc66166224a791a3cc2ebb6b3e3585b9777f66a1616ec34648fb9bf0b1833cb8fe1
-
memory/1328-58-0x0000000000000000-mapping.dmp
-
memory/1732-54-0x0000000000250000-0x00000000002CE000-memory.dmpFilesize
504KB
-
memory/1732-55-0x0000000000380000-0x0000000000388000-memory.dmpFilesize
32KB
-
memory/1732-56-0x0000000004720000-0x0000000004774000-memory.dmpFilesize
336KB
-
memory/1732-57-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/1736-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1736-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1736-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1736-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1736-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1736-66-0x00000000004470CE-mapping.dmp
-
memory/1736-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1736-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB