Overview

overview

10

Static

static

SecuriteIn...02.exe

windows7_x64

10

SecuriteIn...02.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    26-02-2021 09:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKDZ.73184.1978.29102.exe

  • Size

    531KB

  • MD5

    9feb0a5719f215f9a50ec42f4e139c31

  • SHA1

    c83e0f257259030ae0c65a2f0312f5a2e056113d

  • SHA256

    d99e9fd1092f9fa603bb5b45c91f716778d8a293eb5588969022d6a4e6834fc1

  • SHA512

    f422ad8406f1ec7a4cda5459ac37542b61168e977a0a53b16290aa1150e20bc517a26acd18eecb87de32ec211d2919bc16a6e9c8b8e536ff9c37165139c9760c

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @Mexico1.,

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.1978.29102.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.1978.29102.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nvfnQRNZVaV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp732D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1416
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.1978.29102.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.1978.29102.exe"
      2⤵
        PID:1168
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.1978.29102.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.1978.29102.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:724

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp732D.tmp
      MD5

      f2ae8af3e53a818b7dc071e2d0f7b231

      SHA1

      d548c2f39da5fd4260adbe2a13970eb12966f015

      SHA256

      66157186643bed66b90e429db736fdf56dd67e15881e44afbff180bac930e3ad

      SHA512

      a9f6a8354a2c40ce4da908af990bd2df1e5986d51283271864cb683696164f90b912a4185ac9b8cddaad06101860220c736f0269581ed251a2f4baaadd3f13f1

      Download Submit
    • memory/548-2-0x0000000074B50000-0x000000007523E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/548-3-0x0000000000840000-0x0000000000841000-memory.dmp
      Filesize

      4KB

      Download
    • memory/548-5-0x0000000004B90000-0x0000000004B91000-memory.dmp
      Filesize

      4KB

      Download
    • memory/548-6-0x00000000005A0000-0x00000000005A3000-memory.dmp
      Filesize

      12KB

      Download
    • memory/548-7-0x0000000004B20000-0x0000000004B7C000-memory.dmp
      Filesize

      368KB

      Download
    • memory/724-10-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/724-11-0x000000000043747E-mapping.dmp
      Download
    • memory/724-12-0x0000000074B50000-0x000000007523E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/724-13-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/724-15-0x00000000049C0000-0x00000000049C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1416-8-0x0000000000000000-mapping.dmp
      Download