Overview

overview

10

Static

static

DELIVERY F...SX.exe

windows7_x64

10

DELIVERY F...SX.exe

windows10_x64

10

Analysis

  • max time kernel
    131s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    21-10-2021 13:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DELIVERY FOLLOW UP.XLSX.exe

  • Size

    481KB

  • MD5

    75c0f9a2900015e3b9ab6b5433706786

  • SHA1

    787a8a7cd60f220e41b0aed7605db324c06dc786

  • SHA256

    d794df300789db006c10efb29a8cd2683c72070312700eff88f82e40c5548667

  • SHA512

    e13e8d0fb150a033f9a1e5544a25494fec5f3fb8476d80c0c3fcd45399a44c269a79c40bcc443fe3efd6b595c898b06e714996b36a1076034ca29075ac09d6ec

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.bulletproofprotections.com
  • Port:
    587
  • Username:
    account@bulletproofprotections.com
  • Password:
    Everest10account

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 3 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DELIVERY FOLLOW UP.XLSX.exe
    "C:\Users\Admin\AppData\Local\Temp\DELIVERY FOLLOW UP.XLSX.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Users\Admin\AppData\Local\Temp\DELIVERY FOLLOW UP.XLSX.exe
      "C:\Users\Admin\AppData\Local\Temp\DELIVERY FOLLOW UP.XLSX.exe"
      2⤵
      • Drops file in Drivers directory
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 1384
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3408

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4372-115-0x00000000009E0000-0x00000000009E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4372-117-0x0000000005820000-0x0000000005821000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4372-118-0x0000000005320000-0x0000000005321000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4372-119-0x0000000005320000-0x000000000581E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/4372-120-0x0000000005280000-0x0000000005281000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4372-121-0x0000000005300000-0x0000000005307000-memory.dmp
    Filesize

    28KB

    Download
  • memory/4372-122-0x0000000006040000-0x0000000006041000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4372-123-0x00000000060E0000-0x0000000006138000-memory.dmp
    Filesize

    352KB

    Download
  • memory/4528-124-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/4528-125-0x000000000043779E-mapping.dmp
    Download
  • memory/4528-130-0x00000000051B0000-0x00000000056AE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/4528-131-0x00000000052F0000-0x00000000052F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4528-132-0x0000000005E10000-0x0000000005E11000-memory.dmp
    Filesize

    4KB

    Download