Overview

overview

10

Static

static

PG4636 - C...ls.exe

windows7_x64

3

PG4636 - C...ls.exe

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    01-12-2021 08:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PG4636 - Confirmed .xls.exe

  • Size

    606KB

  • MD5

    3a2199d390e17bd3ce0020a46c851962

  • SHA1

    5d5ae3312b305075168e1527be9ef0a9ebcc4a9d

  • SHA256

    f0c05e6f2059ef50c62fbc48da8fc8ca14cba911e504941fd44860537b186fb7

  • SHA512

    99ba10a6c17bf3f92f69833f034496cbb65aef26be740c27fcf569553457c32fb6156cd01bbea180efc19c08aaa48bc4711e4448db1313f036f2827ec353822c

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.neocomjsp.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    f@kHRCt0

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe
    "C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe
      "C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe"
      2⤵
        PID:3772
      • C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe
        "C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe"
        2⤵
          PID:4092
        • C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe
          "C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe"
          2⤵
            PID:2956
          • C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe
            "C:\Users\Admin\AppData\Local\Temp\PG4636 - Confirmed .xls.exe"
            2⤵
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • outlook_office_path
            • outlook_win_path
            PID:3960

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Credentials in Files

        3
        T1081

        Discovery

        Lateral Movement

        Collection

        Data from Local System

        3
        T1005

        Email Collection

        1
        T1114

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2488-115-0x0000000000B00000-0x0000000000B01000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2488-117-0x0000000005860000-0x0000000005861000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2488-118-0x0000000005400000-0x0000000005401000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2488-119-0x0000000005360000-0x000000000585E000-memory.dmp
          Filesize

          5.0MB

          Download
        • memory/2488-120-0x00000000053F0000-0x00000000053F1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2488-121-0x0000000005850000-0x0000000005856000-memory.dmp
          Filesize

          24KB

          Download
        • memory/2488-122-0x0000000008DA0000-0x0000000008DA1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2488-123-0x0000000008FD0000-0x000000000905E000-memory.dmp
          Filesize

          568KB

          Download
        • memory/3960-124-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/3960-125-0x00000000004375FE-mapping.dmp
          Download
        • memory/3960-130-0x0000000005650000-0x0000000005B4E000-memory.dmp
          Filesize

          5.0MB

          Download
        • memory/3960-131-0x00000000056A0000-0x00000000056A1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3960-132-0x0000000006340000-0x0000000006341000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3960-135-0x0000000005650000-0x0000000005B4E000-memory.dmp
          Filesize

          5.0MB

          Download