Overview

overview

10

Static

static

proforma i...21.exe

windows7_x64

10

proforma i...21.exe

windows10_x64

10

Analysis

  • max time kernel
    124s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    21-01-2021 06:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    proforma invoice 2021.exe

  • Size

    1004KB

  • MD5

    00edc489136213b678dfc8e8c6b569b9

  • SHA1

    16d23523207c3cc14cff2d4250ffc1adfb2d06c6

  • SHA256

    c0e329ca358ea987ca675f970275c62807172b7d8d6e3f9a8761ba55c5497d31

  • SHA512

    4ec9f97ee50c686755ad7e47bbca9cf2ba1eec87d68afd4ddec0d30bc5375eb05247d54a7bbb840b050c6eb8da1b6b6d4e76f497370b8ef8f6e2c217d7cd7c85

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.dicon.md
  • Port:
    587
  • Username:
    nado@dicon.md
  • Password:
    Nneoma1234@

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\proforma invoice 2021.exe
    "C:\Users\Admin\AppData\Local\Temp\proforma invoice 2021.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Users\Admin\AppData\Local\Temp\proforma invoice 2021.exe
      "{path}"
      2⤵
        PID:4072
      • C:\Users\Admin\AppData\Local\Temp\proforma invoice 2021.exe
        "{path}"
        2⤵
          PID:3396
        • C:\Users\Admin\AppData\Local\Temp\proforma invoice 2021.exe
          "{path}"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3176

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\proforma invoice 2021.exe.log
        MD5

        0c2899d7c6746f42d5bbe088c777f94c

        SHA1

        622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

        SHA256

        5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

        SHA512

        ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

        Download Submit
      • memory/3176-12-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/3176-22-0x0000000005B20000-0x0000000005B21000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3176-21-0x0000000005A80000-0x0000000005A81000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3176-20-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3176-15-0x0000000073900000-0x0000000073FEE000-memory.dmp
        Filesize

        6.9MB

        Download
      • memory/3176-13-0x000000000043748E-mapping.dmp
        Download
      • memory/4688-7-0x00000000052F0000-0x00000000052F1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4688-11-0x0000000007890000-0x0000000007891000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4688-10-0x0000000007760000-0x00000000077EF000-memory.dmp
        Filesize

        572KB

        Download
      • memory/4688-9-0x0000000005510000-0x000000000551E000-memory.dmp
        Filesize

        56KB

        Download
      • memory/4688-8-0x00000000055F0000-0x00000000055F1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4688-2-0x0000000073900000-0x0000000073FEE000-memory.dmp
        Filesize

        6.9MB

        Download
      • memory/4688-6-0x0000000005390000-0x0000000005391000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4688-5-0x00000000057F0000-0x00000000057F1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4688-3-0x00000000009B0000-0x00000000009B1000-memory.dmp
        Filesize

        4KB

        Download