Overview

overview

10

Static

static

apr.20.Pro...le.exe

windows7_x64

10

apr.20.Pro...le.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    20-04-2021 14:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    apr.20.Product.Sample.exe

  • Size

    914KB

  • MD5

    54be59d38b7cd8b17b2a61dc223b9ba4

  • SHA1

    9f53e465983fef1d75c125f02f561eb367ffc7c3

  • SHA256

    00e029505f08409c263a00c64d9afb68ce25af2c87ce9aff7b8533b965294215

  • SHA512

    77f8f867d4a19be4c9a4ecfa26ac9baa67621d7217017164bf11f61635bd0363bb450d71f70b050223c89419ce001c9f77d0aa183dfd9899861abf179d1236c7

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://199.188.200.93/
  • Port:
    21
  • Username:
    oralogvj
  • Password:
    BNHColCvgMdA

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 3 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\apr.20.Product.Sample.exe
    "C:\Users\Admin\AppData\Local\Temp\apr.20.Product.Sample.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zUTKSKQC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D77.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:304
    • C:\Users\Admin\AppData\Local\Temp\apr.20.Product.Sample.exe
      "C:\Users\Admin\AppData\Local\Temp\apr.20.Product.Sample.exe"
      2⤵
      • Drops file in Drivers directory
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:820

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp9D77.tmp
    MD5

    f36a2c223180174a6223363deebfbafe

    SHA1

    39c822cb13124a95d1a486fef18a5001c225c6db

    SHA256

    5077125732d10825f0b507ce4608943da59b08ce4b83e93eec3b158eec76aa81

    SHA512

    ba9c7abf0ea32735536e51bcbaaf5e956af101858fac6d46a7d2e64dcaea2a3cce07c1fbbc006e6cd7ccbd354547ba5b109bfe10a7a8d314038fb4fe14fb137f

    Download Submit
  • memory/304-67-0x0000000000000000-mapping.dmp
    Download
  • memory/820-70-0x000000000043772E-mapping.dmp
    Download
  • memory/820-69-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/820-71-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/820-73-0x0000000004A30000-0x0000000004A31000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1684-60-0x0000000000090000-0x0000000000091000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1684-62-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1684-63-0x0000000000760000-0x0000000000769000-memory.dmp
    Filesize

    36KB

    Download
  • memory/1684-64-0x000000007EF40000-0x000000007EF41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1684-65-0x00000000055A0000-0x0000000005622000-memory.dmp
    Filesize

    520KB

    Download
  • memory/1684-66-0x00000000021D0000-0x000000000221A000-memory.dmp
    Filesize

    296KB

    Download