Overview

overview

10

Static

static

SecuriteIn...15.exe

windows7_x64

10

SecuriteIn...15.exe

windows10_x64

10

Analysis

  • max time kernel
    64s
  • max time network
    10s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    30-01-2021 21:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Inject4.6861.3506.17315.exe

  • Size

    896KB

  • MD5

    8ecb4e5a7e2da81cfc68069c61d873a0

  • SHA1

    e8c8d58739e60ef0ffa0ae2999b73eb8a711c7a6

  • SHA256

    9767f24cdeb959ecd20b003f7d9744c216b3bbcaae6ddc5d481a4cce2ea8e91f

  • SHA512

    0ef9bca72cc846949a8bb7039be6aaee3c56bf52642d5142cea50a5563130719bd4ccf0e8c5ce0598866aef5171c047faf378f8f0c5dd12ff348dc877cbbd6f8

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.godforeu.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    O8k#Pz4sk:w_

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6861.3506.17315.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6861.3506.17315.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AbxDCd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD97D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1648
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6861.3506.17315.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6861.3506.17315.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 516
        3⤵
          PID:972

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpD97D.tmp
      MD5

      5f0686ba33592adb3b0c68a1e4a433d6

      SHA1

      89997f30c15ef49397a887a420c8c8f4a730fa13

      SHA256

      c66394f1d141ff9397cd615fbbeedfd4b31a6fe6c246c720775aa6327cf91b27

      SHA512

      1eae724ee27bd01825cfe931e81b56513d07e1a87ea90c2cd5efe2a95ceaf4e32c51a56fb219ec0538d9ace725f72d2e48d8909db9c7737214320c4cf7804bdb

      Download Submit

    • memory/972-11-0x0000000000000000-mapping.dmp

      Download

    • memory/972-12-0x0000000001E90000-0x0000000001EA1000-memory.dmp

      Filesize

      68KB

      Download

    • memory/972-14-0x0000000000550000-0x0000000000551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1124-7-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

      Download

    • memory/1124-8-0x00000000004374CE-mapping.dmp

      Download

    • memory/1124-10-0x0000000000320000-0x0000000000321000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1648-5-0x0000000000000000-mapping.dmp

      Download

    • memory/1684-2-0x00000000756A1000-0x00000000756A3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1684-3-0x0000000000380000-0x0000000000381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1684-4-0x0000000000381000-0x0000000000382000-memory.dmp

      Filesize

      4KB

      Download