Overview

overview

10

Static

static

10

catalogue.exe

windows7_x64

10

catalogue.exe

windows10_x64

10

Analysis

  • max time kernel
    74s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-11-2020 19:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    catalogue.exe

  • Size

    515KB

  • MD5

    1c098e2524570249e1aa01afe50f3dde

  • SHA1

    f130b0404f94fb4ddfdd918b58734dc73d3e814f

  • SHA256

    d43c6aba8577d6f6e846545d25587748ff13e676320936f4c3104ba94e22e24c

  • SHA512

    b67b7f19b4dd15179720a82f2f62ce6a709b3adad7299afc86eff1cf8f00ebb660d710c8cf6b8d3bd7ef4653c41a4447e11e60cce817056494dffc9ee055ba91

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    admin@cairoways.me
  • Password:
    requestShow@

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\catalogue.exe
    "C:\Users\Admin\AppData\Local\Temp\catalogue.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:592
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jZUqGdZLb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBB28.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3404
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:308
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:2164

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpBB28.tmp
      MD5

      339cbb32f0100c13367271bcc73d4ddd

      SHA1

      7d02788af676c7cfc7fffdc8e0aec5445a999aa6

      SHA256

      e775dc77e760b597ebc283fca92ac69d5422c7953debbe3e314b90b8eabd649f

      SHA512

      f8e1c3cb4cf8aafcf6294acf9c20c618d5ef8a02fcc45a27ee24e3887cfbe7829042c05d446fdab5c304beba0227e74fbcacd27fc981600d3d5f9c89853bc2af

      Download Submit
    • memory/308-5-0x0000000000400000-0x0000000000452000-memory.dmp
      Filesize

      328KB

      Download
    • memory/308-6-0x000000000044C8CE-mapping.dmp
      Download
    • memory/2164-7-0x0000000000000000-mapping.dmp
      Download
    • memory/3404-3-0x0000000000000000-mapping.dmp
      Download