Overview

overview

10

Static

static

Purchase O...9).exe

windows7_x64

10

Purchase O...9).exe

windows10_x64

10

Analysis

  • max time kernel
    44s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    30-06-2020 09:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19).exe

  • Size

    455KB

  • MD5

    4c2b89f7f2367057d2b74c7cf3eccdd9

  • SHA1

    f9ecfab5740a0d2947686dc6802e9759214be317

  • SHA256

    87f94a2fca72d8b4a2317257b3333d415ea4a9f28ac1470967f7b30e775030c2

  • SHA512

    ade26b27b1c6335fecfd88e6cfc15bc347ce6e302548ba4fdfd4811fb42a0c569b3aaab1a5aaa55c4a1c33a7ee7414a26734c39fb58cfeb59af4b3db57daa737

Score
10/10
keyloggertrojanstealerspywareagenttesla

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19).exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19).exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "{path}"
      2⤵
        PID:1384
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "{path}"
        2⤵
          PID:1228
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
          "{path}"
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious behavior: EnumeratesProcesses
          PID:1784

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1784-0-0x0000000000400000-0x0000000000450000-memory.dmp
        Filesize

        320KB

        Download
      • memory/1784-1-0x000000000044AB5E-mapping.dmp
        Download
      • memory/1784-2-0x0000000000400000-0x0000000000450000-memory.dmp
        Filesize

        320KB

        Download
      • memory/1784-3-0x0000000000400000-0x0000000000450000-memory.dmp
        Filesize

        320KB

        Download