Overview

overview

10

Static

static

DOCUMENT.BAT.exe

windows7_x64

10

DOCUMENT.BAT.exe

windows10_x64

10

Analysis

  • max time kernel
    127s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    19-10-2021 01:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DOCUMENT.BAT.exe

  • Size

    491KB

  • MD5

    509657bf2cda328547347fb08192a545

  • SHA1

    dda0893857e46e43a869a2a0c0171d83da2c6fc5

  • SHA256

    fec4bd7fec11af96dc833563d61a8424e0e4bb0b332b5b423a871583c0fd44ca

  • SHA512

    29b9cc7df360740a51b560fe5a4b87f829ed706c7cdab4a508513d29c8b0c3318e1fcbe3dc2c3bd2d844570ccca14b7306f8e741e6468590630e74ab3f4d4eac

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.mudanzasdistintas.com.ar
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    icui4cu2@@

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DOCUMENT.BAT.exe
    "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.BAT.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Users\Admin\AppData\Local\Temp\DOCUMENT.BAT.exe
      "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.BAT.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1832-124-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/1832-132-0x0000000006430000-0x0000000006431000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1832-131-0x0000000006390000-0x0000000006391000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1832-130-0x0000000005600000-0x0000000005601000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1832-125-0x0000000000436DCE-mapping.dmp
    Download
  • memory/2632-119-0x00000000058B0000-0x00000000058B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2632-122-0x000000000B550000-0x000000000B558000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2632-123-0x000000000B930000-0x000000000B987000-memory.dmp
    Filesize

    348KB

    Download
  • memory/2632-121-0x000000000B5F0000-0x000000000B5F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2632-120-0x00000000058E0000-0x0000000005DDE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/2632-115-0x0000000000F50000-0x0000000000F51000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2632-118-0x0000000005800000-0x0000000005801000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2632-117-0x0000000005DE0000-0x0000000005DE1000-memory.dmp
    Filesize

    4KB

    Download