Overview

overview

10

Static

static

2020060308...67.exe

windows7_x64

10

2020060308...67.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    86s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    30-06-2020 13:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2020060308611765434567.exe

  • Size

    426KB

  • MD5

    73879715ca072971d061ab4a227a649c

  • SHA1

    ceb47d58621b19e04ae737f12ad71f1b2ff5ebf5

  • SHA256

    d9db86325cb63915a31775ab7b78f14802fa077e3aed9122f0fb03e9f39d05f2

  • SHA512

    1be81a26cb07a2904b3defc3b3feae63a57ea0e757671fc90147428803d8f286ff1d6e48ddb160bf11b6b569fcef7c8b376d7b5c7c04f77c1ada75c2847791b7

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    gb@ronodo-online.com
  • Password:
    mmm777

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2020060308611765434567.exe
    "C:\Users\Admin\AppData\Local\Temp\2020060308611765434567.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bheWEoOklI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1090.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2080
    • C:\Users\Admin\AppData\Local\Temp\2020060308611765434567.exe
      "{path}"
      2⤵
        PID:2712
      • C:\Users\Admin\AppData\Local\Temp\2020060308611765434567.exe
        "{path}"
        2⤵
          PID:2792
        • C:\Users\Admin\AppData\Local\Temp\2020060308611765434567.exe
          "{path}"
          2⤵
          • Drops file in Drivers directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2812

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\2020060308611765434567.exe.log
        MD5

        ef140ef600b2463c9e7dbf064a104046

        SHA1

        c08fd1853877be95575ea2e860dd8cafef31f54c

        SHA256

        ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616

        SHA512

        bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\tmp1090.tmp
        MD5

        4352e5d8a60d2ba6fc301371920401c9

        SHA1

        c35d112500e14588d6dbae0357486559b0fd4d4c

        SHA256

        6c28408578a63ad484dd9e7a7784ab86c8b370a9e6261214bb7e904e01ea434a

        SHA512

        e724bbc9ef584a2f324b62c543816d07e996485a9e91c026ba6dd3400a4afb126d1895b42a60eca95b0a512f38130cef428db9d4dc4cdb4ff8ea8c2653225cab

        Download Submit
      • memory/2080-0-0x0000000000000000-mapping.dmp
        Download
      • memory/2812-2-0x0000000000400000-0x000000000044C000-memory.dmp
        Filesize

        304KB

        Download
      • memory/2812-3-0x00000000004478EE-mapping.dmp
        Download