Analysis
-
max time kernel
130s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:46
Static task
static1
Behavioral task
behavioral1
Sample
CONSIGNEE BL. NO GLNL20063871.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
CONSIGNEE BL. NO GLNL20063871.exe
Resource
win10v2004-20220414-en
General
-
Target
CONSIGNEE BL. NO GLNL20063871.exe
-
Size
392KB
-
MD5
eafb5ecce79a78ff6f61de7830e3c492
-
SHA1
f6d454e65aabcf2ee7c13eb01b776e2d557bf30f
-
SHA256
841418cdd1e9639a6a192eb8f9fd9881f042f49a7cb2bd3463a8a6964a424b50
-
SHA512
99a64b81a8dbe8ae3a2f2601111fbf52f94cf496d4475b2635862ae6473a81e8d1faa5b69b941d0d0e0c361b2a39ea731033143c6cdad45ac8c6295381e5ca35
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.daiphatfood.com.vn - Port:
587 - Username:
supin@daiphatfood.com.vn - Password:
jn&6kG~_w;;A
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/880-62-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/880-63-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/880-65-0x0000000000446BAE-mapping.dmp family_agenttesla behavioral1/memory/880-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/880-67-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/880-69-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CONSIGNEE BL. NO GLNL20063871.exedescription pid process target process PID 1732 set thread context of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
CONSIGNEE BL. NO GLNL20063871.exeCONSIGNEE BL. NO GLNL20063871.exepid process 1732 CONSIGNEE BL. NO GLNL20063871.exe 1732 CONSIGNEE BL. NO GLNL20063871.exe 1732 CONSIGNEE BL. NO GLNL20063871.exe 1732 CONSIGNEE BL. NO GLNL20063871.exe 1732 CONSIGNEE BL. NO GLNL20063871.exe 880 CONSIGNEE BL. NO GLNL20063871.exe 880 CONSIGNEE BL. NO GLNL20063871.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
CONSIGNEE BL. NO GLNL20063871.exeCONSIGNEE BL. NO GLNL20063871.exedescription pid process Token: SeDebugPrivilege 1732 CONSIGNEE BL. NO GLNL20063871.exe Token: SeDebugPrivilege 880 CONSIGNEE BL. NO GLNL20063871.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
CONSIGNEE BL. NO GLNL20063871.exedescription pid process target process PID 1732 wrote to memory of 1160 1732 CONSIGNEE BL. NO GLNL20063871.exe schtasks.exe PID 1732 wrote to memory of 1160 1732 CONSIGNEE BL. NO GLNL20063871.exe schtasks.exe PID 1732 wrote to memory of 1160 1732 CONSIGNEE BL. NO GLNL20063871.exe schtasks.exe PID 1732 wrote to memory of 1160 1732 CONSIGNEE BL. NO GLNL20063871.exe schtasks.exe PID 1732 wrote to memory of 2040 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 2040 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 2040 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 2040 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 1536 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 1536 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 1536 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 1536 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 2036 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 2036 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 2036 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 2036 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 892 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 892 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 892 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 892 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe PID 1732 wrote to memory of 880 1732 CONSIGNEE BL. NO GLNL20063871.exe CONSIGNEE BL. NO GLNL20063871.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CONSIGNEE BL. NO GLNL20063871.exe"C:\Users\Admin\AppData\Local\Temp\CONSIGNEE BL. NO GLNL20063871.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\abzwxpuJVYDQjR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1363.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\CONSIGNEE BL. NO GLNL20063871.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CONSIGNEE BL. NO GLNL20063871.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CONSIGNEE BL. NO GLNL20063871.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CONSIGNEE BL. NO GLNL20063871.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CONSIGNEE BL. NO GLNL20063871.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1363.tmpFilesize
1KB
MD5e55b113d3b8aa8a8f38c0993565e09cc
SHA13c21421b6217ef2da85be2df729d7c1e0c1eab26
SHA2563812b3014e84d98c21f9f9e97cb93e6c6ee97f43ce2a5d70b5a7b3b35befab63
SHA512bb6eb21596331938aca155463b0d0f15caa450ef3b4d5d33d070c2dbbe3fca892b6372711c1e4e68411970d790f076e0773dfc4316c81ae7f8bc5bde134971e1
-
memory/880-65-0x0000000000446BAE-mapping.dmp
-
memory/880-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/880-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/880-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/880-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/880-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/880-67-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/880-69-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/880-70-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/1160-57-0x0000000000000000-mapping.dmp
-
memory/1732-56-0x0000000000630000-0x0000000000684000-memory.dmpFilesize
336KB
-
memory/1732-55-0x0000000000430000-0x0000000000438000-memory.dmpFilesize
32KB
-
memory/1732-54-0x00000000001E0000-0x0000000000248000-memory.dmpFilesize
416KB