Analysis
-
max time kernel
179s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:33
General
-
Target
excel doc spec.scr
-
Size
834KB
-
MD5
4dc022310f86d0f94a74d8c0a7e7c58a
-
SHA1
e809aa0cfcc7d387bc4451015a751e685b1ddf7e
-
SHA256
92605cf78b7b975754a9defe3570dc6b30917fdfbc0d62f601145c28930c21f2
-
SHA512
e5da3f734a56435b815728353b5391358fad11752493a13c0b4aa21419a7f3de244b849986aa70b17be84699523767b822e2d502f3b376586e791663fcdb0a53
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\excel doc spec.scr"C:\Users\Admin\AppData\Local\Temp\excel doc spec.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 15883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4076 -ip 40761⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
memory/3860-130-0x0000000000AD0000-0x0000000000BA6000-memory.dmpFilesize
856KB
-
memory/3860-131-0x0000000005B40000-0x00000000060E4000-memory.dmpFilesize
5.6MB
-
memory/3860-132-0x0000000005670000-0x0000000005702000-memory.dmpFilesize
584KB
-
memory/3860-133-0x0000000005820000-0x0000000005864000-memory.dmpFilesize
272KB
-
memory/3860-134-0x00000000069B0000-0x00000000069D2000-memory.dmpFilesize
136KB
-
memory/4076-135-0x0000000000000000-mapping.dmp
-
memory/4076-139-0x0000000000830000-0x0000000000882000-memory.dmpFilesize
328KB
-
memory/4076-140-0x0000000005010000-0x00000000050AC000-memory.dmpFilesize
624KB
-
memory/4076-141-0x0000000005520000-0x0000000005586000-memory.dmpFilesize
408KB
-
memory/4076-142-0x0000000006140000-0x0000000006190000-memory.dmpFilesize
320KB