Overview

overview

10

Static

static

REQUEST FO...20.exe

windows7_x64

10

REQUEST FO...20.exe

windows10_x64

10

Analysis

  • max time kernel
    98s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-11-2020 19:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    REQUEST FOR PROPOSAL - KHAI QUOC TDR-05052020.exe

  • Size

    599KB

  • MD5

    99f2fcd36d14a8993a1f5af2cba8d2ed

  • SHA1

    acfad8fb18e290240ddc2be6157057e2a89d5bb9

  • SHA256

    27ef45a0e5db4ffe4e67ae3ce507aaf93e5618df7a12f1d443a5aea81cb2a895

  • SHA512

    8fe37906c97bbc4f6b440deee253c7068b43e7f6a0363c014b542bca41d2231fda6454bbcfd99af67108b758a6ca515a9cb996ecabdde7e1b432bbed4772dcfd

Score
10/10
agentteslakeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    terry.miller@rm-elactrical.com
  • Password:
    EQQDdWP2

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 2 IoCs
  • rezer0 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\REQUEST FOR PROPOSAL - KHAI QUOC TDR-05052020.exe
    "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR PROPOSAL - KHAI QUOC TDR-05052020.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eyeuKLWfEyt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB2C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3108
    • C:\Users\Admin\AppData\Local\Temp\REQUEST FOR PROPOSAL - KHAI QUOC TDR-05052020.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3696
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:68

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    3
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REQUEST FOR PROPOSAL - KHAI QUOC TDR-05052020.exe.log
      MD5

      b4f7a6a57cb46d94b72410eb6a6d45a9

      SHA1

      69f3596ffa027202d391444b769ceea0ae14c5f7

      SHA256

      23994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b

      SHA512

      be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\tmpB2C.tmp
      MD5

      1a4357fcd7c1d66695dcc00e8fa6a6be

      SHA1

      3b96273c5303394a55ad83cd5ccbab8d376cb052

      SHA256

      f35a8182ac910621ee4909bfdeda3bba713b0f521c4bbf1e1004e2bfe6e43aa7

      SHA512

      a89d99ffab1c77f1bd7bed4a52c54de427f0abc338458b816aa0be20edf4688acf9767f657aa1143351b91c6bff85add1144acb3325f7d9179509d940c9fe2f5

      Download Submit
    • memory/68-27-0x0000000000000000-mapping.dmp
      Download
    • memory/3108-15-0x0000000000000000-mapping.dmp
      Download
    • memory/3240-14-0x0000000007340000-0x0000000007393000-memory.dmp
      Filesize

      332KB

      Download
    • memory/3240-3-0x0000000004EC0000-0x0000000004F19000-memory.dmp
      Filesize

      356KB

      Download
    • memory/3240-12-0x0000000005580000-0x0000000005583000-memory.dmp
      Filesize

      12KB

      Download
    • memory/3240-13-0x0000000008AB0000-0x0000000008AB1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3240-0-0x0000000073970000-0x000000007405E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3240-7-0x0000000005390000-0x0000000005391000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3240-4-0x00000000057F0000-0x00000000057F1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3240-11-0x0000000005310000-0x0000000005311000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3240-1-0x0000000000570000-0x0000000000571000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3696-18-0x000000000044CBBE-mapping.dmp
      Download
    • memory/3696-20-0x0000000073970000-0x000000007405E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3696-25-0x0000000005750000-0x0000000005751000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3696-26-0x0000000006210000-0x0000000006211000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3696-17-0x0000000000400000-0x0000000000452000-memory.dmp
      Filesize

      328KB

      Download