Overview

overview

10

Static

static

10

CL00485Q19...TB.exe

windows7_x64

10

CL00485Q19...TB.exe

windows10_x64

10

Analysis

  • max time kernel
    56s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-11-2020 19:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CL00485Q1902589CLSCTB.exe

  • Size

    505KB

  • MD5

    714917e5b4ddcfe8f1aed4a31944ee8b

  • SHA1

    32a82506a74300c541983b66ebc7179bb674374f

  • SHA256

    2393c64f19e5818eb506a2f8660be2a81ad6ec357baf132fa62ee30828d01fe9

  • SHA512

    bb607a11cd9b45325bda1c42776a6e205210eaa73939ad28bfa5cb0cbe8424a85fbb4660c45a68cf108d8e14938efc9d827247c319868b3abdc219cf32490c01

Score
10/10
agentteslacoreentitykeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    gabby.anthony@yandex.com
  • Password:
    43210001234

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity
  • AgentTesla Payload 4 IoCs
  • rezer0 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CL00485Q1902589CLSCTB.exe
    "C:\Users\Admin\AppData\Local\Temp\CL00485Q1902589CLSCTB.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\CL00485Q1902589CLSCTB.exe
      "{path}"
      2⤵
        PID:884
      • C:\Users\Admin\AppData\Local\Temp\CL00485Q1902589CLSCTB.exe
        "{path}"
        2⤵
          PID:452
        • C:\Users\Admin\AppData\Local\Temp\CL00485Q1902589CLSCTB.exe
          "{path}"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:888
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" wlan show profile
            3⤵
              PID:1952

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Credentials in Files

        3
        T1081

        Discovery

        Lateral Movement

        Collection

        Data from Local System

        3
        T1005

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/888-6-0x0000000000400000-0x0000000000450000-memory.dmp
          Filesize

          320KB

          Download
        • memory/888-7-0x000000000044AE5E-mapping.dmp
          Download
        • memory/888-8-0x0000000000400000-0x0000000000450000-memory.dmp
          Filesize

          320KB

          Download
        • memory/888-9-0x0000000000400000-0x0000000000450000-memory.dmp
          Filesize

          320KB

          Download
        • memory/888-10-0x0000000073860000-0x0000000073F4E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/1320-0-0x0000000074570000-0x0000000074C5E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/1320-1-0x0000000001390000-0x0000000001391000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1320-4-0x00000000004B0000-0x00000000004B3000-memory.dmp
          Filesize

          12KB

          Download
        • memory/1320-5-0x0000000008010000-0x0000000008061000-memory.dmp
          Filesize

          324KB

          Download
        • memory/1952-13-0x0000000000000000-mapping.dmp
          Download
        • memory/1976-3-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp
          Filesize

          2.5MB

          Download