Overview

overview

10

Static

static

REVISED FI...df.exe

windows7_x64

10

REVISED FI...df.exe

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    20-10-2021 06:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    REVISED FINAL ORDER LIST-pdf.exe

  • Size

    32KB

  • MD5

    5518dd63ae04917f0647f698d49f5c1a

  • SHA1

    fdf1f3970ab95e67765517bb29b8e2dc06bfcc5e

  • SHA256

    51b9a732f19371ba83e4d9f920665d7ff402a57782ff43fd447cff2c73c6397d

  • SHA512

    297af2b964d802effa7ceda0a16027d3a63da84f581bdc5fa9bc6d668cb0fd5493931287e875f92f4fc8f769ffc68735ee62d3ccfa21882b44bd1947ee65bfe4

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.fclbd.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    abc@123@

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe"
      2⤵
        PID:4344
      • C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe"
        2⤵
          PID:1688
        • C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • outlook_office_path
          • outlook_win_path
          PID:4568

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REVISED FINAL ORDER LIST-pdf.exe.log
        MD5

        808e884c00533a9eb0e13e64960d9c3a

        SHA1

        279d05181fc6179a12df1a669ff5d8b64c1380ae

        SHA256

        2f6a0aab99b1c228a6642f44f8992646ce84c5a2b3b9941b6cf1f2badf67bdd6

        SHA512

        9489bdb2ffdfeef3c52edcfe9b34c6688eba53eb86075e0564df1cd474723c86b5b5aedc12df1ff5fc12cf97bd1e3cf9701ff61dc4ce90155d70e9ccfd0fc299

        Download Submit

      • memory/3592-119-0x00000000056F0000-0x0000000005714000-memory.dmp

        Filesize

        144KB

        Download

      • memory/3592-117-0x0000000004B00000-0x0000000004B01000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3592-115-0x0000000000150000-0x0000000000151000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3592-118-0x0000000005620000-0x000000000566C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4568-126-0x0000000005500000-0x0000000005501000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4568-121-0x000000000043765E-mapping.dmp

        Download

      • memory/4568-125-0x0000000005960000-0x0000000005961000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4568-120-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/4568-127-0x0000000005460000-0x000000000595E000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/4568-128-0x00000000055A0000-0x00000000055A1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4568-129-0x0000000006050000-0x0000000006051000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4568-130-0x0000000006740000-0x0000000006741000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4568-131-0x0000000001030000-0x0000000001031000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4568-132-0x0000000005460000-0x000000000595E000-memory.dmp

        Filesize

        5.0MB

        Download