Overview

overview

10

Static

static

SecuriteIn...95.exe

windows7_x64

10

SecuriteIn...95.exe

windows10_x64

10

Analysis

  • max time kernel
    36s
  • max time network
    69s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-01-2021 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.BehavesLike.Win32.Generic.qm.195.exe

  • Size

    56KB

  • MD5

    dfd545dbc01cac5d86f94dd0a3c8d675

  • SHA1

    86b077d904d1f9bbb11d897a78e38924a421e0e8

  • SHA256

    5defd50046db301c82c85cc8306960982f576cbf5446f24062cc570dcf0becec

  • SHA512

    72d3f60e21187b9feb34a28fe4464bbc54e6fbf3c329476657d8a4a89ad2ce632223f2a1226af0488f7ceeda7c3c836288de9110a0868042670c7e74e61a01b7

Score
10/10
agentteslaevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Windows security bypass 2 TTPs
    evasiontrojan
  • AgentTesla Payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Windows security modification 2 TTPs 4 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.qm.195.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.qm.195.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Drops startup file
    • Windows security modification
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Generic.qm.195.exe" -Force
      2⤵
        PID:1380
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Generic.qm.195.exe" -Force
        2⤵
          PID:2136
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.BehavesLike.Win32.Generic.qm.195.exe" -Force
          2⤵
            PID:3868
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.qm.195.exe" -Force
            2⤵
              PID:3204

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Winlogon Helper DLL

          1
          T1004

          Registry Run Keys / Startup Folder

          1
          T1060

          Privilege Escalation

          Defense Evasion

          Modify Registry

          4
          T1112

          Disabling Security Tools

          2
          T1089

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Discovery

          Query Registry

          4
          T1012

          Virtualization/Sandbox Evasion

          2
          T1497

          System Information Discovery

          3
          T1082

          Peripheral Device Discovery

          1
          T1120

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1052-11-0x00000000065F0000-0x00000000065F1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1052-5-0x0000000005850000-0x0000000005851000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1052-2-0x0000000073BE0000-0x00000000742CE000-memory.dmp
            Filesize

            6.9MB

            Download
          • memory/1052-6-0x0000000005400000-0x0000000005401000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1052-7-0x0000000005620000-0x0000000005621000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1052-8-0x0000000005540000-0x0000000005541000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1052-9-0x00000000053F0000-0x00000000053F1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1052-10-0x0000000006510000-0x0000000006574000-memory.dmp
            Filesize

            400KB

            Download
          • memory/1052-3-0x0000000000A90000-0x0000000000A91000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1380-15-0x0000000073BE0000-0x00000000742CE000-memory.dmp
            Filesize

            6.9MB

            Download
          • memory/1380-18-0x00000000071A0000-0x00000000071A1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1380-19-0x00000000078F0000-0x00000000078F1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1380-12-0x0000000000000000-mapping.dmp
            Download
          • memory/2136-13-0x0000000000000000-mapping.dmp
            Download
          • memory/2136-17-0x0000000073BE0000-0x00000000742CE000-memory.dmp
            Filesize

            6.9MB

            Download
          • memory/3204-16-0x0000000000000000-mapping.dmp
            Download
          • memory/3868-21-0x0000000073BE0000-0x00000000742CE000-memory.dmp
            Filesize

            6.9MB

            Download
          • memory/3868-14-0x0000000000000000-mapping.dmp
            Download