Overview

overview

10

Static

static

ITEM DETAI...hu.exe

windows7_x64

10

ITEM DETAI...hu.exe

windows10_x64

10

Analysis

  • max time kernel
    8s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-11-2020 20:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ITEM DETAILS.Tianzhu.exe

  • Size

    513KB

  • MD5

    9c4f3f542fde993ae0e0571456356dc4

  • SHA1

    78c600279ce2819abeddc7020cadce67b36394da

  • SHA256

    590bd4f24a79d69139ca6b32de3e1b88029eed2ab6444a9975826e04361f3ebb

  • SHA512

    a08ee02827c5843462c46a4bdeb348ac2c85e2d7981a364e7b600c6fb3f4af4620fc53ee228e74a0ce1c7a7fd3aea8c4331739adccb2fe0435f1f932bbb9a1ec

Score
10/10
agentteslacoreentitykeyloggerrezer0spywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity
  • AgentTesla Payload 1 IoCs
  • rezer0 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ITEM DETAILS.Tianzhu.exe
    "C:\Users\Admin\AppData\Local\Temp\ITEM DETAILS.Tianzhu.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1744

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1744-0-0x00000000741A0000-0x000000007488E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1744-1-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1744-3-0x0000000000540000-0x0000000000598000-memory.dmp
    Filesize

    352KB

    Download
  • memory/1744-9-0x0000000000300000-0x0000000000302000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1744-10-0x0000000000B90000-0x0000000000BE0000-memory.dmp
    Filesize

    320KB

    Download
  • memory/1744-11-0x0000000002070000-0x00000000020B9000-memory.dmp
    Filesize

    292KB

    Download