Analysis
-
max time kernel
120s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:59
Static task
static1
Behavioral task
behavioral1
Sample
PO_UCWEB.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO_UCWEB.exe
Resource
win10v2004-20220414-en
General
-
Target
PO_UCWEB.exe
-
Size
800KB
-
MD5
df0158771e58f80c1346943b393d92f6
-
SHA1
7293ed7ec4181d06b0f626bd9ebdef74f5e4850a
-
SHA256
6cfda8d801be1dc0741573babb2b48ccec13814faf7100875d32517d12d3ea60
-
SHA512
f03cbb9bbc3b183564c309087f5a73cee668791bf3bd12d92d312e95fa1d3a3b3e3858c24158749921bb093edc32704b8b946c7997976c07bba80aaf1fd8c7bb
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1836-60-0x0000000004130000-0x000000000417C000-memory.dmp family_agenttesla -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1836-57-0x0000000001F40000-0x0000000001F94000-memory.dmp rezer0 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO_UCWEB.exepid process 1836 PO_UCWEB.exe 1836 PO_UCWEB.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO_UCWEB.exedescription pid process Token: SeDebugPrivilege 1836 PO_UCWEB.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
PO_UCWEB.exedescription pid process target process PID 1836 wrote to memory of 1776 1836 PO_UCWEB.exe schtasks.exe PID 1836 wrote to memory of 1776 1836 PO_UCWEB.exe schtasks.exe PID 1836 wrote to memory of 1776 1836 PO_UCWEB.exe schtasks.exe PID 1836 wrote to memory of 1776 1836 PO_UCWEB.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_UCWEB.exe"C:\Users\Admin\AppData\Local\Temp\PO_UCWEB.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KfuCgI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E97.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3E97.tmpFilesize
1KB
MD504453e8ccd87b667e1433ce6bb85bbce
SHA1446a5f42d3f28543cbc9966b77e5d26f88cabbf6
SHA2562e17965004a9023c04a5ffbdff6c0face715f856baa5c52e32a321031b27d55a
SHA5125023aaae3e3445848009de3e09ff140cd7187195b6d2566e81296b3c5df58b63910dab8acc327aa5ab12d0acebb98d4fca19b7acde6e7f5fae6dffd3af49ddd7
-
memory/1776-58-0x0000000000000000-mapping.dmp
-
memory/1836-54-0x0000000000890000-0x000000000095E000-memory.dmpFilesize
824KB
-
memory/1836-55-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1836-56-0x0000000000280000-0x0000000000288000-memory.dmpFilesize
32KB
-
memory/1836-57-0x0000000001F40000-0x0000000001F94000-memory.dmpFilesize
336KB
-
memory/1836-60-0x0000000004130000-0x000000000417C000-memory.dmpFilesize
304KB