Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-03-2023 01:26
Static task
static1
Behavioral task
behavioral1
Sample
5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe
Resource
win10v2004-20230220-en
General
-
Target
5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe
-
Size
1.1MB
-
MD5
5b1f4e2b1ae240311980d2f6186cf88e
-
SHA1
36e0e9c15f9d21c9ecbd40ac3bdf03ab34245c82
-
SHA256
5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1
-
SHA512
42db37dbf80ce648f72e7afcb8be38b9c81c30e366531d913b9e690c69312d551ef217e343a8810e1c024124cc516df9108ecb299533357ad818e20bd1ab2162
-
SSDEEP
12288:zWHNC1Q/rusz7NxS+Q7+GvwP2FAihZ+YBtskhYT75geR5Of6oAGGomaJQWRu125X:sLGHK5EGjtWo1raPMVu
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mibmglobal.com - Port:
587 - Username:
kavita@mibmglobal.com - Password:
mibmg3010! - Email To:
davidsurly1@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exedescription pid process target process PID 288 set thread context of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1420 1924 WerFault.exe Setup.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exepid process 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exedescription pid process Token: SeDebugPrivilege 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exeSetup.exedescription pid process target process PID 288 wrote to memory of 1712 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe aspnet_compiler.exe PID 288 wrote to memory of 1712 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe aspnet_compiler.exe PID 288 wrote to memory of 1712 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe aspnet_compiler.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 288 wrote to memory of 1924 288 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe Setup.exe PID 1924 wrote to memory of 1420 1924 Setup.exe WerFault.exe PID 1924 wrote to memory of 1420 1924 Setup.exe WerFault.exe PID 1924 wrote to memory of 1420 1924 Setup.exe WerFault.exe PID 1924 wrote to memory of 1420 1924 Setup.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe"C:\Users\Admin\AppData\Local\Temp\5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 3043⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-54-0x0000000000920000-0x0000000000A46000-memory.dmpFilesize
1.1MB
-
memory/288-55-0x000000001B2C0000-0x000000001B340000-memory.dmpFilesize
512KB
-
memory/288-56-0x0000000000860000-0x00000000008CE000-memory.dmpFilesize
440KB
-
memory/1924-57-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB