Overview

overview

10

Static

static

HCM - JACK...FL.exe

windows7_x64

10

HCM - JACK...FL.exe

windows10_x64

10

Analysis

  • max time kernel
    129s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    20-04-2021 19:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HCM - JACKSONVILLE, FL.exe

  • Size

    1.1MB

  • MD5

    74bd64c0ec695f0f8177b08bd961c2db

  • SHA1

    a0df1a7e20933db43bdd8b44ffcfe466fbebdec0

  • SHA256

    cd04b35e2ed6848898fb8a61a027f9546ac28413012a48c428ce76d36312de43

  • SHA512

    1f659e11081ae83c252e5dd4cf761bb4e76a8ce2ad650982ed650dc6fc9227c6c798c74e2c0c91edd05a037f1ba8c1016148cc43b770005d76895b02f8b3b27a

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.framafilms.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    lister11

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 4 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HCM - JACKSONVILLE, FL.exe
    "C:\Users\Admin\AppData\Local\Temp\HCM - JACKSONVILLE, FL.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Users\Admin\AppData\Local\Temp\HCM - JACKSONVILLE, FL.exe
      "{path}"
      2⤵
        PID:3808
      • C:\Users\Admin\AppData\Local\Temp\HCM - JACKSONVILLE, FL.exe
        "{path}"
        2⤵
          PID:2664
        • C:\Users\Admin\AppData\Local\Temp\HCM - JACKSONVILLE, FL.exe
          "{path}"
          2⤵
            PID:3636
          • C:\Users\Admin\AppData\Local\Temp\HCM - JACKSONVILLE, FL.exe
            "{path}"
            2⤵
              PID:2772
            • C:\Users\Admin\AppData\Local\Temp\HCM - JACKSONVILLE, FL.exe
              "{path}"
              2⤵
              • Drops file in Drivers directory
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4000

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HCM - JACKSONVILLE, FL.exe.log
            MD5

            0c2899d7c6746f42d5bbe088c777f94c

            SHA1

            622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

            SHA256

            5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

            SHA512

            ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

            Download Submit

          • memory/3992-123-0x0000000006F90000-0x0000000006FFF000-memory.dmp

            Filesize

            444KB

            Download

          • memory/3992-116-0x0000000007810000-0x0000000007811000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3992-118-0x0000000007360000-0x0000000007361000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3992-119-0x0000000007310000-0x000000000780E000-memory.dmp

            Filesize

            5.0MB

            Download

          • memory/3992-120-0x0000000004880000-0x0000000004885000-memory.dmp

            Filesize

            20KB

            Download

          • memory/3992-121-0x0000000008F10000-0x0000000008F11000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3992-117-0x00000000073B0000-0x00000000073B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3992-114-0x0000000000540000-0x0000000000541000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3992-122-0x000000000AAB0000-0x000000000AB61000-memory.dmp

            Filesize

            708KB

            Download

          • memory/4000-125-0x000000000043760E-mapping.dmp

            Download

          • memory/4000-124-0x0000000000400000-0x000000000043C000-memory.dmp

            Filesize

            240KB

            Download

          • memory/4000-131-0x0000000005230000-0x000000000572E000-memory.dmp

            Filesize

            5.0MB

            Download

          • memory/4000-132-0x0000000005700000-0x0000000005701000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4000-133-0x0000000005D90000-0x0000000005D91000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4000-136-0x0000000005230000-0x000000000572E000-memory.dmp

            Filesize

            5.0MB

            Download