Overview

overview

10

Static

static

90dd925b19...41.exe

windows7_x64

10

90dd925b19...41.exe

windows10_x64

10

Analysis

  • max time kernel
    104s
  • max time network
    88s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    21-07-2021 19:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90dd925b1990f66414717bf179f8c041.exe

  • Size

    940KB

  • MD5

    90dd925b1990f66414717bf179f8c041

  • SHA1

    7dbf76751d6eed6f84a3c17bea67ff8dc1cb3735

  • SHA256

    424c2b2020c57524e9478cc214bd98ec2abee1f3fb2fb7b2db54c5e90f877b18

  • SHA512

    3dfcf2955004657d74e78db86e1c01e1dfba97dcd76b534bd0afbb856f0ee3403a5b281098bbfd025ed99f8025407fb2362e795ad2f07ca905e17d2fbf69ce89

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.hotelharmika.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Playboy007

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90dd925b1990f66414717bf179f8c041.exe
    "C:\Users\Admin\AppData\Local\Temp\90dd925b1990f66414717bf179f8c041.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wcRbWlnzleWVVX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE418.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1324
    • C:\Users\Admin\AppData\Local\Temp\90dd925b1990f66414717bf179f8c041.exe
      "C:\Users\Admin\AppData\Local\Temp\90dd925b1990f66414717bf179f8c041.exe"
      2⤵
        PID:636
      • C:\Users\Admin\AppData\Local\Temp\90dd925b1990f66414717bf179f8c041.exe
        "C:\Users\Admin\AppData\Local\Temp\90dd925b1990f66414717bf179f8c041.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        PID:608

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpE418.tmp
      MD5

      22f440c66310abd63761f3e9b16eb898

      SHA1

      85213671e481c11c490aa8610e34682c8789e7a9

      SHA256

      f28e24596841f7aa911bdeb91a041f9cb45b0056595dd814fe8349a6db9d69c2

      SHA512

      83a26beb30685429b0c90a3f457d69a3241035385657dcc25ac843e7c03c0708e1e976db77abde2c50769079053731d37243f1a149d134cfc69640e8c4ac22a5

      Download Submit
    • memory/608-67-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/608-68-0x000000000043766E-mapping.dmp
      Download
    • memory/608-69-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/608-71-0x0000000004A10000-0x0000000004A11000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1028-59-0x00000000000B0000-0x00000000000B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1028-61-0x0000000002120000-0x0000000002121000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1028-62-0x00000000005D0000-0x00000000005EB000-memory.dmp
      Filesize

      108KB

      Download
    • memory/1028-63-0x0000000004D70000-0x0000000004DEA000-memory.dmp
      Filesize

      488KB

      Download
    • memory/1028-64-0x0000000004780000-0x00000000047B9000-memory.dmp
      Filesize

      228KB

      Download
    • memory/1324-65-0x0000000000000000-mapping.dmp
      Download