Overview

overview

10

Static

static

2282a50d33...09.exe

windows7_x64

10

2282a50d33...09.exe

windows10_x64

10

Analysis

  • max time kernel
    94s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    27-01-2021 14:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe

  • Size

    2.0MB

  • MD5

    e5b5fde8d8579dca685c942019b10ea1

  • SHA1

    1c33a8d5d1775777f45793e5e97d408fe055b13f

  • SHA256

    2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209

  • SHA512

    cb3643c8e54cd2adad6090f6f9d24ae7e4979580aa02c0c9f96640297c95e0cf315198043560103b14e082f5cc3d399931de1b4bc51c4f24297af26a1a024319

Score
10/10
agentteslaevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1430527829:AAEVOge50SoiKIG8DObypzFsov8W5H9ybDc/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • AgentTesla Payload 2 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe
    "C:\Users\Admin\AppData\Local\Temp\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Drops startup file
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\AppData\Local\Temp\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe
      "C:\Users\Admin\AppData\Local\Temp\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2282a50d33177e982a0704829cc50539d08a71329ca5afb9132a29b94011a209.exe.log
    MD5

    c841b0053b0a6f0dab24458cda1d9b63

    SHA1

    1eca8f4096c7867bca4369d5b6afcb9d6842c796

    SHA256

    23ef5f7437f13263563874ec855363339baead4b4a1b2eca7bf4db5f9fd7b13a

    SHA512

    7c159346ec6950a56b436a3c28ee8cc1131e2fa76db03863222da8d7e1d3b5cc81367eaae86c9d98aa52ff813f39701740bfe93002b6b5d872621613d404ff43

    Download Submit
  • memory/192-19-0x0000000005560000-0x0000000005561000-memory.dmp
    Filesize

    4KB

    Download
  • memory/192-10-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/192-23-0x0000000005871000-0x0000000005872000-memory.dmp
    Filesize

    4KB

    Download
  • memory/192-22-0x0000000002F80000-0x0000000002F81000-memory.dmp
    Filesize

    4KB

    Download
  • memory/192-11-0x000000000043778E-mapping.dmp
    Download
  • memory/192-21-0x0000000006500000-0x0000000006501000-memory.dmp
    Filesize

    4KB

    Download
  • memory/192-18-0x0000000005870000-0x0000000005871000-memory.dmp
    Filesize

    4KB

    Download
  • memory/192-13-0x00000000739A0000-0x000000007408E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/756-8-0x0000000005630000-0x0000000005631000-memory.dmp
    Filesize

    4KB

    Download
  • memory/756-3-0x00000000009F0000-0x00000000009F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/756-5-0x0000000005490000-0x0000000005491000-memory.dmp
    Filesize

    4KB

    Download
  • memory/756-2-0x00000000739A0000-0x000000007408E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/756-9-0x0000000005530000-0x0000000005531000-memory.dmp
    Filesize

    4KB

    Download
  • memory/756-7-0x0000000005B40000-0x0000000005B41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/756-6-0x0000000002E50000-0x0000000002E9A000-memory.dmp
    Filesize

    296KB

    Download