Analysis
-
max time kernel
182s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 08:51
Static task
static1
Behavioral task
behavioral1
Sample
6b43e60fcb0a1858f5eb12437020dfc7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6b43e60fcb0a1858f5eb12437020dfc7.exe
Resource
win10v2004-20221111-en
General
-
Target
6b43e60fcb0a1858f5eb12437020dfc7.exe
-
Size
742KB
-
MD5
6b43e60fcb0a1858f5eb12437020dfc7
-
SHA1
5a80f7cad8a5d5e5e6c833941314a74dfbf374d0
-
SHA256
b02d61086cfa6f876e71f4eb2ba5bae874887cf3ef87c339cc634151a388f679
-
SHA512
5518e247d38d371a846c10b554c55dedf32e5c67824f38d7b2676ff83bbc12f4c2145a81869cb0c102fcff80ff9459ecb1ae943c5bdda0da561ccafe3bdd47a3
-
SSDEEP
12288:kwlVmomPZefVPtqvyuswNI3C/2eNp0XcMevpMq14wZev/cJFuJN+4i/2I2DlZ8jF:UomxiVQFngC50XuvuBwZucyC525Z0Z
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
server323.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
turkey@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6b43e60fcb0a1858f5eb12437020dfc7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RMBJLaF = "C:\\Users\\Admin\\AppData\\Roaming\\RMBJLaF\\RMBJLaF.exe" 6b43e60fcb0a1858f5eb12437020dfc7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6b43e60fcb0a1858f5eb12437020dfc7.exedescription pid process target process PID 364 set thread context of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6b43e60fcb0a1858f5eb12437020dfc7.exepid process 2988 6b43e60fcb0a1858f5eb12437020dfc7.exe 2988 6b43e60fcb0a1858f5eb12437020dfc7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6b43e60fcb0a1858f5eb12437020dfc7.exedescription pid process Token: SeDebugPrivilege 2988 6b43e60fcb0a1858f5eb12437020dfc7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6b43e60fcb0a1858f5eb12437020dfc7.exedescription pid process target process PID 364 wrote to memory of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe PID 364 wrote to memory of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe PID 364 wrote to memory of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe PID 364 wrote to memory of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe PID 364 wrote to memory of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe PID 364 wrote to memory of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe PID 364 wrote to memory of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe PID 364 wrote to memory of 2988 364 6b43e60fcb0a1858f5eb12437020dfc7.exe 6b43e60fcb0a1858f5eb12437020dfc7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b43e60fcb0a1858f5eb12437020dfc7.exe"C:\Users\Admin\AppData\Local\Temp\6b43e60fcb0a1858f5eb12437020dfc7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6b43e60fcb0a1858f5eb12437020dfc7.exe"C:\Users\Admin\AppData\Local\Temp\6b43e60fcb0a1858f5eb12437020dfc7.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-132-0x0000000000900000-0x00000000009BE000-memory.dmpFilesize
760KB
-
memory/364-133-0x0000000005840000-0x0000000005DE4000-memory.dmpFilesize
5.6MB
-
memory/364-134-0x0000000005350000-0x00000000053E2000-memory.dmpFilesize
584KB
-
memory/364-135-0x0000000005580000-0x000000000558A000-memory.dmpFilesize
40KB
-
memory/364-136-0x0000000007870000-0x000000000790C000-memory.dmpFilesize
624KB
-
memory/2988-137-0x0000000000000000-mapping.dmp
-
memory/2988-138-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2988-139-0x0000000005DD0000-0x0000000005E36000-memory.dmpFilesize
408KB