Overview

overview

10

Static

static

INVOICE & ...DF.exe

windows7_x64

10

INVOICE & ...DF.exe

windows10_x64

10

Analysis

  • max time kernel
    127s
  • max time network
    23s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    27-09-2021 14:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    INVOICE & TELEX BL_PDF.exe

  • Size

    862KB

  • MD5

    22a2657bb48e3303f6f0a0fd1fdfe441

  • SHA1

    d6a230a732f3d691a7fce60081f30627ffabd33d

  • SHA256

    85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac

  • SHA512

    5e24b5f9c3886c9fdeaa968ccc59882b24a4c4cf8d90f4ae7d44ba4ed96bc91800d2f98c1eace2426a5dfe7a16f7c1233b1d54607d17ccba490d9e03514d569c

Score
10/10
agentteslaevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.zfftcn.com
  • Port:
    587
  • Username:
    slot2@zfftcn.com
  • Password:
    *VNHf^L9

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 3 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1668
    • C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe"
      2⤵
        PID:1416
      • C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe"
        2⤵
          PID:1404
        • C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe
          "C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe"
          2⤵
            PID:624
          • C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe
            "C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe"
            2⤵
              PID:1652
            • C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe
              "C:\Users\Admin\AppData\Local\Temp\INVOICE & TELEX BL_PDF.exe"
              2⤵
              • Drops file in Drivers directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1508

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Credentials in Files

          3
          T1081

          Discovery

          Query Registry

          4
          T1012

          Virtualization/Sandbox Evasion

          2
          T1497

          System Information Discovery

          3
          T1082

          Peripheral Device Discovery

          1
          T1120

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1508-62-0x0000000000400000-0x000000000043C000-memory.dmp
            Filesize

            240KB

            Download
          • memory/1508-70-0x0000000004911000-0x0000000004912000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1508-69-0x0000000004910000-0x0000000004911000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1508-64-0x0000000000400000-0x000000000043C000-memory.dmp
            Filesize

            240KB

            Download
          • memory/1508-63-0x00000000004375EE-mapping.dmp
            Download
          • memory/1568-58-0x0000000007EF0000-0x0000000007F58000-memory.dmp
            Filesize

            416KB

            Download
          • memory/1568-59-0x0000000004310000-0x000000000434C000-memory.dmp
            Filesize

            240KB

            Download
          • memory/1568-54-0x00000000001B0000-0x00000000001B1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1568-57-0x0000000000300000-0x0000000000307000-memory.dmp
            Filesize

            28KB

            Download
          • memory/1568-56-0x0000000004350000-0x0000000004351000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1668-61-0x0000000075A71000-0x0000000075A73000-memory.dmp
            Filesize

            8KB

            Download
          • memory/1668-60-0x0000000000000000-mapping.dmp
            Download
          • memory/1668-68-0x0000000001C42000-0x0000000001C44000-memory.dmp
            Filesize

            8KB

            Download
          • memory/1668-66-0x0000000001C40000-0x0000000001C41000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1668-67-0x0000000001C41000-0x0000000001C42000-memory.dmp
            Filesize

            4KB

            Download