Overview

overview

10

Static

static

Scanned doc.exe

windows7_x64

10

Scanned doc.exe

windows10_x64

3

Analysis

  • max time kernel
    112s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    31-07-2020 13:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Scanned doc.exe

  • Size

    482KB

  • MD5

    70cf26be4ca82d7a3e0c7092d02d0520

  • SHA1

    33701ba7b7ecec46decec6095dd47eb455f540d6

  • SHA256

    a7af597188e3940ae7010e605d11e10b33f48632d2fec2c061c0c46d75c531b1

  • SHA512

    50241a5e3863c3c249f00cbfebeabe705509f7cd4a4d2521334959ed0f50694dd8ce105dd3274e038ceb72fc2e22a49f3209f8f163ca2c95c0d10ed96e45376f

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    goksal.sir@prosoftelektrik.com
  • Password:
    Wm^kN*!7

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Scanned doc.exe
    "C:\Users\Admin\AppData\Local\Temp\Scanned doc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC273.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:744
    • C:\Users\Admin\AppData\Local\Temp\Scanned doc.exe
      "{path}"
      2⤵
        PID:1052
      • C:\Users\Admin\AppData\Local\Temp\Scanned doc.exe
        "{path}"
        2⤵
          PID:1540
        • C:\Users\Admin\AppData\Local\Temp\Scanned doc.exe
          "{path}"
          2⤵
            PID:1520
          • C:\Users\Admin\AppData\Local\Temp\Scanned doc.exe
            "{path}"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1708

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Credential Access

        Credentials in Files

        3
        T1081

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        3
        T1005

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpC273.tmp
          MD5

          77fb853e8f745f44d1f5fd3577ce772f

          SHA1

          7ffc71dfb041c0e963f683674e36301e362b723e

          SHA256

          0e57ac65e9146f47af2721b6824882ff549df9106874faf0e2f417eb555476e4

          SHA512

          6a2963e9df68e0ec62c19d93ca56bd4086f11aca6249e333bddf1254149ad3b09077e0d67e77ed2dffd5ab8cedbbe26e643a2d8c50fba79994d4305b630b091a

          Download Submit
        • memory/744-2-0x0000000000000000-mapping.dmp
          Download
        • memory/1460-1-0x0000000000000000-0x0000000000000000-disk.dmp
          Download
        • memory/1708-8-0x0000000000400000-0x000000000044C000-memory.dmp
          Filesize

          304KB

          Download
        • memory/1708-9-0x00000000004469FE-mapping.dmp
          Download
        • memory/1708-10-0x0000000000400000-0x000000000044C000-memory.dmp
          Filesize

          304KB

          Download
        • memory/1708-11-0x0000000000400000-0x000000000044C000-memory.dmp
          Filesize

          304KB

          Download