Overview

overview

10

Static

static

SKU1008800...st.exe

windows7_x64

10

SKU1008800...st.exe

windows10_x64

10

Analysis

  • max time kernel
    125s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    21-10-2021 13:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SKU10088002 loading photos and container comm inv and packing list.exe

  • Size

    566KB

  • MD5

    0e8b01d10cce62d28f58897bad493b57

  • SHA1

    63cddbb8231c3f1d61fb528cb74902d047038018

  • SHA256

    b1fe3e4522b701047d35e034db5ed2e9b8b10619b15f3d1a0b44b8da1a499352

  • SHA512

    86506f1bb54d5f7362bfbe548737af89cf4c0afe939152619d6bd08460b086ebca47cb35b18a273e82bb27f6c7400665883635612d2245bc18509b131a9dc4ef

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.electronmash.com
  • Port:
    587
  • Username:
    office@electronmash.com
  • Password:
    Zanzibar2018

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SKU10088002 loading photos and container comm inv and packing list.exe
    "C:\Users\Admin\AppData\Local\Temp\SKU10088002 loading photos and container comm inv and packing list.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PJmhGQzpevP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DA1.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3564
    • C:\Users\Admin\AppData\Local\Temp\SKU10088002 loading photos and container comm inv and packing list.exe
      "{path}"
      2⤵
        PID:2876
      • C:\Users\Admin\AppData\Local\Temp\SKU10088002 loading photos and container comm inv and packing list.exe
        "{path}"
        2⤵
          PID:2888
        • C:\Users\Admin\AppData\Local\Temp\SKU10088002 loading photos and container comm inv and packing list.exe
          "{path}"
          2⤵
            PID:1508
          • C:\Users\Admin\AppData\Local\Temp\SKU10088002 loading photos and container comm inv and packing list.exe
            "{path}"
            2⤵
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • outlook_office_path
            • outlook_win_path
            PID:1644

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Credential Access

        Credentials in Files

        3
        T1081

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        3
        T1005

        Email Collection

        1
        T1114

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SKU10088002 loading photos and container comm inv and packing list.exe.log
          MD5

          90acfd72f14a512712b1a7380c0faf60

          SHA1

          40ba4accb8faa75887e84fb8e38d598dc8cf0f12

          SHA256

          20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

          SHA512

          29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\tmp3DA1.tmp
          MD5

          36057332bb1cc08f9555bcfaef26b8bb

          SHA1

          94d9f412766f05a5c84bb55a0d7f5b1c4ccdf374

          SHA256

          4946f32df760bf59cec61517f872d88c2f5641fac69af9dba535ef9b3e094584

          SHA512

          7e1dd4657c7285ba7b25ce93d0720fc702d2d4139a25b059165b8aec32c2c56ec0e14a3bfa2cc4a4230da5301a16d137d453d219bb918c09c15870247a3881f6

          Download Submit
        • memory/1644-140-0x0000000005570000-0x0000000005A6E000-memory.dmp
          Filesize

          5.0MB

          Download
        • memory/1644-137-0x0000000006260000-0x0000000006261000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1644-136-0x00000000056C0000-0x00000000056C1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1644-135-0x0000000005570000-0x0000000005A6E000-memory.dmp
          Filesize

          5.0MB

          Download
        • memory/1644-129-0x000000000043761E-mapping.dmp
          Download
        • memory/1644-128-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/2752-120-0x0000000005040000-0x000000000553E000-memory.dmp
          Filesize

          5.0MB

          Download
        • memory/2752-125-0x00000000085A0000-0x00000000085D8000-memory.dmp
          Filesize

          224KB

          Download
        • memory/2752-124-0x0000000005FF0000-0x000000000606F000-memory.dmp
          Filesize

          508KB

          Download
        • memory/2752-123-0x00000000050B0000-0x00000000050BE000-memory.dmp
          Filesize

          56KB

          Download
        • memory/2752-122-0x00000000052A0000-0x00000000052A1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2752-121-0x0000000005090000-0x0000000005091000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2752-115-0x0000000000740000-0x0000000000741000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2752-119-0x00000000050E0000-0x00000000050E1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2752-118-0x0000000005540000-0x0000000005541000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2752-117-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3564-126-0x0000000000000000-mapping.dmp
          Download