Overview

overview

10

Static

static

2282a50d33...09.exe

windows7_x64

10

2282a50d33...09.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    27-01-2021 14:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe

  • Size

    2.0MB

  • MD5

    e5b5fde8d8579dca685c942019b10ea1

  • SHA1

    1c33a8d5d1775777f45793e5e97d408fe055b13f

  • SHA256

    2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209

  • SHA512

    cb3643c8e54cd2adad6090f6f9d24ae7e4979580aa02c0c9f96640297c95e0cf315198043560103b14e082f5cc3d399931de1b4bc51c4f24297af26a1a024319

Score
10/10
agentteslaevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1430527829:AAEVOge50SoiKIG8DObypzFsov8W5H9ybDc/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • AgentTesla Payload 3 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe
    "C:\Users\Admin\AppData\Local\Temp\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Drops startup file
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\AppData\Local\Temp\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe
      "C:\Users\Admin\AppData\Local\Temp\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/996-8-0x000000000043778E-mapping.dmp
    Download
  • memory/996-7-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/996-9-0x00000000743D0000-0x0000000074ABE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/996-10-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/996-12-0x0000000004D30000-0x0000000004D31000-memory.dmp
    Filesize

    4KB

    Download
  • memory/996-13-0x0000000004D31000-0x0000000004D32000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1880-2-0x00000000743D0000-0x0000000074ABE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1880-3-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1880-5-0x0000000000540000-0x000000000058A000-memory.dmp
    Filesize

    296KB

    Download
  • memory/1880-6-0x0000000004F30000-0x0000000004F31000-memory.dmp
    Filesize

    4KB

    Download