Overview

overview

10

Static

static

1

??40208 Ac...ch.exe

windows7_x64

10

??40208 Ac...ch.exe

windows10_x64

10

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    21-10-2021 03:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ??40208 Accell Asia Limited Taiwan Branch.exe

  • Size

    540KB

  • MD5

    1a1063bd01a0f01cecb94f9efc1bf7f1

  • SHA1

    c4ef80030868b1e8dcda424e082004cc8af4e66f

  • SHA256

    bd492d0d70877fb5b6eeb357cb8c57efa47df4d5d7cc6547958da94cbfddd7d3

  • SHA512

    5be288dcc77978c974f54cad7822c40c61fb0462efb99d621b99d54ab01343e6f629d257d527a517843c3f58d5f0c38f9dd15d5713433802ada83f71ef056b4f

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\__40208 Accell Asia Limited Taiwan Branch.exe
    "C:\Users\Admin\AppData\Local\Temp\__40208 Accell Asia Limited Taiwan Branch.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\__40208 Accell Asia Limited Taiwan Branch.exe
      "C:\Users\Admin\AppData\Local\Temp\__40208 Accell Asia Limited Taiwan Branch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 508
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsdC092.tmp\jxalbh.dll
    MD5

    f6dc83a169c1cb3d0330da420f2157a1

    SHA1

    9b528977445219b3b6c422dd650f85fc3374a76a

    SHA256

    44480473703cf2507ea7921710f13a151b0d22426b6696d3a8689d89d1954f58

    SHA512

    8b2b6f09bf10ceb36298ccc7c7745df4735e766576ef4dd20daa36e41101f02d84607dc162f31ad8c0c98ae25a7b546273340852da7dfdfe18f747f4daf2071b

    Download Submit
  • memory/320-55-0x0000000000400000-0x000000000044B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/320-56-0x000000000040188B-mapping.dmp
    Download
  • memory/320-59-0x0000000001F40000-0x0000000001F41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/320-60-0x0000000001F41000-0x0000000001F42000-memory.dmp
    Filesize

    4KB

    Download
  • memory/320-58-0x0000000000400000-0x000000000044B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/320-61-0x0000000001F42000-0x0000000001F44000-memory.dmp
    Filesize

    8KB

    Download
  • memory/320-62-0x0000000001F47000-0x0000000001F48000-memory.dmp
    Filesize

    4KB

    Download
  • memory/320-63-0x0000000001F48000-0x0000000001F49000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1736-64-0x0000000000000000-mapping.dmp
    Download
  • memory/1736-66-0x0000000000490000-0x0000000000491000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2040-53-0x0000000075BD1000-0x0000000075BD3000-memory.dmp
    Filesize

    8KB

    Download