Overview
overview
10Static
static
8122de0842b...0d.exe
windows7_x64
6122de0842b...0d.exe
windows10_x64
621837bd6a7...27.exe
windows7_x64
1021837bd6a7...27.exe
windows10_x64
1030131519d2...fc.exe
windows7_x64
130131519d2...fc.exe
windows10_x64
53be39aebff...7a.exe
windows7_x64
83be39aebff...7a.exe
windows10_x64
85514456013...b8.exe
windows7_x64
105514456013...b8.exe
windows10_x64
1061d44476de...3e.exe
windows7_x64
961d44476de...3e.exe
windows10_x64
96ee50d84fd...c3.exe
windows7_x64
86ee50d84fd...c3.exe
windows10_x64
882c04fda59...b5.exe
windows7_x64
182c04fda59...b5.exe
windows10_x64
1a101cc8e9f...75.exe
windows7_x64
8a101cc8e9f...75.exe
windows10_x64
8b5674726f7...b0.exe
windows7_x64
6b5674726f7...b0.exe
windows10_x64
8c939f36967...08.exe
windows7_x64
8c939f36967...08.exe
windows10_x64
8de36168cfc...49.exe
windows7_x64
10de36168cfc...49.exe
windows10_x64
10eb9775066c...4d.exe
windows7_x64
10eb9775066c...4d.exe
windows10_x64
10Analysis
-
max time kernel
137s -
max time network
39s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-01-2021 02:37
Behavioral task
behavioral1
Sample
122de0842b4df547c9bddfb0b594a1b8f8b55da501c6f35b038153981cf1870d.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
122de0842b4df547c9bddfb0b594a1b8f8b55da501c6f35b038153981cf1870d.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
21837bd6a795e92f326fe1a26523411408c5e8ad38054353c55ffc514e72b927.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
21837bd6a795e92f326fe1a26523411408c5e8ad38054353c55ffc514e72b927.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
30131519d29744c302b7cc68898c5238358a75a0c01d398b3df894896620cbfc.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
30131519d29744c302b7cc68898c5238358a75a0c01d398b3df894896620cbfc.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
3be39aebffed61e79f7bd2405d3e2722a1cf388a820b819ff76c1c1a132fd37a.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
3be39aebffed61e79f7bd2405d3e2722a1cf388a820b819ff76c1c1a132fd37a.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
61d44476deb3368a54bb936e56a7aadb9226e78b88f67f939ed1cf0932f3263e.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
61d44476deb3368a54bb936e56a7aadb9226e78b88f67f939ed1cf0932f3263e.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
Resource
win7v20201028
Behavioral task
behavioral14
Sample
6ee50d84fd4795440107550e6581ccb981f87dff2f216e5cc5a0314144b83ec3.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
82c04fda5985f51abe024bfda867bc3aaa0ffd26a500cd7cc40f8238df9b1eb5.exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
82c04fda5985f51abe024bfda867bc3aaa0ffd26a500cd7cc40f8238df9b1eb5.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
a101cc8e9f1eac76c6fc006e9e746b59dc94b73e1358803ad94d70a0938d3a75.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
a101cc8e9f1eac76c6fc006e9e746b59dc94b73e1358803ad94d70a0938d3a75.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
b5674726f7f51d5880211f8ca8aea069bc6fc758794748117db27b8df25a12b0.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
b5674726f7f51d5880211f8ca8aea069bc6fc758794748117db27b8df25a12b0.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
c939f36967412e7e4c1a893ac6c9d38eee2d49516bd9168af2e0a33819ffe708.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
eb9775066c55310131db50ee2606fb66353e4c694d5713abaddd2293806ac34d.exe
Resource
win7v20201028
General
-
Target
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 1504 InstallUtil.exe -
Loads dropped DLL 1 IoCs
Processes:
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exepid process 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exedescription pid process target process PID 1740 set thread context of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exeInstallUtil.exepid process 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe 1504 InstallUtil.exe 1504 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe Token: SeDebugPrivilege 1504 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 1504 InstallUtil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exedescription pid process target process PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe PID 1740 wrote to memory of 1504 1740 5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe"C:\Users\Admin\AppData\Local\Temp\5514456013c5492e1f41e7a6a59cba1bdc6d1555c5b169992aba575cb34cb0b8.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/1504-14-0x000000000043759E-mapping.dmp
-
memory/1504-22-0x0000000004AC1000-0x0000000004AC2000-memory.dmpFilesize
4KB
-
memory/1504-21-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/1504-19-0x0000000000090000-0x0000000000092000-memory.dmpFilesize
8KB
-
memory/1504-18-0x0000000073470000-0x0000000073B5E000-memory.dmpFilesize
6.9MB
-
memory/1504-16-0x0000000000090000-0x00000000000CC000-memory.dmpFilesize
240KB
-
memory/1740-8-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/1740-12-0x0000000004A81000-0x0000000004A82000-memory.dmpFilesize
4KB
-
memory/1740-10-0x00000000005E0000-0x00000000005E1000-memory.dmpFilesize
4KB
-
memory/1740-9-0x0000000000580000-0x000000000058B000-memory.dmpFilesize
44KB
-
memory/1740-2-0x00000000741A0000-0x000000007488E000-memory.dmpFilesize
6.9MB
-
memory/1740-7-0x00000000003B0000-0x00000000003CE000-memory.dmpFilesize
120KB
-
memory/1740-5-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/1740-3-0x0000000001230000-0x0000000001231000-memory.dmpFilesize
4KB