Overview

overview

10

Static

static

10

Thaco Inqu...df.exe

windows7_x64

10

Thaco Inqu...df.exe

windows10_x64

10

Analysis

  • max time kernel
    74s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-11-2020 19:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Thaco Inquiry for Braking System.pdf.exe

  • Size

    530KB

  • MD5

    0a151d62eb179e68a42722e9d52925ae

  • SHA1

    52c5f5175737c2fe381d0198fa1dd89073bfc854

  • SHA256

    582b5b5e548d8cec7fa78533174ec70d5c1e2de0024e639cf73838a401d56d40

  • SHA512

    84c8073de0029d7bda15bd053007969315c9ad49c4cfb323728143761c75680977a9355890b85ebe5ba1e66f1e889c20f31eb5ce48eaefc2f0bde76778b06b7a

Score
10/10
agentteslacoreentitykeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.gtlkwt.com
  • Port:
    587
  • Username:
    info@gtlkwt.com
  • Password:
    gtluniforms

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity
  • AgentTesla Payload 2 IoCs
  • rezer0 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Thaco Inquiry for Braking System.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Thaco Inquiry for Braking System.pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UwwVNqA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp739F.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2720
    • C:\Users\Admin\AppData\Local\Temp\Thaco Inquiry for Braking System.pdf.exe
      "{path}"
      2⤵
        PID:3844
      • C:\Users\Admin\AppData\Local\Temp\Thaco Inquiry for Braking System.pdf.exe
        "{path}"
        2⤵
          PID:3448
        • C:\Users\Admin\AppData\Local\Temp\Thaco Inquiry for Braking System.pdf.exe
          "{path}"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3340
          • C:\Windows\SysWOW64\REG.exe
            REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
            3⤵
            • Modifies registry key
            PID:584
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" wlan show profile
            3⤵
              PID:2452

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials in Files

        3
        T1081

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        3
        T1005

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Thaco Inquiry for Braking System.pdf.exe.log
          MD5

          b4f7a6a57cb46d94b72410eb6a6d45a9

          SHA1

          69f3596ffa027202d391444b769ceea0ae14c5f7

          SHA256

          23994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b

          SHA512

          be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\tmp739F.tmp
          MD5

          cdb3f7f7e8a1ae4e9baf68e74d80428c

          SHA1

          99714eaa0114f4a1fe6e4f6c463cfbaa7ea6be47

          SHA256

          fe37698ef3826b23f550bbe5529ea7b285a7abad257b1661ea93d2fd41272eb1

          SHA512

          c6aef8ad902d487d2bfb81fc55271b251bb94dc13341ad750058c0e1753185403013545aea52249dfa264caac3575f696bb597d4a99ce535cb0b1bfa1aaf4b97

          Download Submit
        • memory/584-29-0x0000000000000000-mapping.dmp
          Download
        • memory/1044-16-0x000000000A4D0000-0x000000000A4D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1044-4-0x0000000007740000-0x0000000007741000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1044-6-0x00000000072B0000-0x00000000072B1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1044-7-0x0000000004660000-0x0000000004663000-memory.dmp
          Filesize

          12KB

          Download
        • memory/1044-15-0x000000000A3D0000-0x000000000A423000-memory.dmp
          Filesize

          332KB

          Download
        • memory/1044-0-0x0000000073BE0000-0x00000000742CE000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/1044-1-0x00000000003A0000-0x00000000003A1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1044-5-0x00000000072E0000-0x00000000072E1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1044-3-0x00000000071E0000-0x0000000007239000-memory.dmp
          Filesize

          356KB

          Download
        • memory/2452-30-0x0000000000000000-mapping.dmp
          Download
        • memory/2720-17-0x0000000000000000-mapping.dmp
          Download
        • memory/3340-20-0x000000000044C94E-mapping.dmp
          Download
        • memory/3340-19-0x0000000000400000-0x0000000000452000-memory.dmp
          Filesize

          328KB

          Download
        • memory/3340-22-0x0000000073BE0000-0x00000000742CE000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3340-27-0x0000000005730000-0x0000000005731000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3340-28-0x0000000006310000-0x0000000006311000-memory.dmp
          Filesize

          4KB

          Download