Overview

overview

10

Static

static

transferen...at.exe

windows7_x64

3

transferen...at.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    02-12-2021 12:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    transferencia rápida_____________________________________________________.bat.exe

  • Size

    489KB

  • MD5

    f4a565d77cd8e4c69808d427001de8c9

  • SHA1

    01f7291b22badc806455ecb367c1dc40ae4de584

  • SHA256

    f80a0debc48dae9e2f07d640314932ef1944c123dba366ecb96d2173446ee7e1

  • SHA512

    b5a7cd6347a2dedf9f7d82f32b5c5c6fe5ffb3a09dcb8f6c26564810a61dc3c2e2aa2800aadc0f71d9ef271fca962d2af17ec0f0fea7d7846040bc1699008ce3

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ydyfg@chinadu2

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\transferencia rápida_____________________________________________________.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\transferencia rápida_____________________________________________________.bat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Users\Admin\AppData\Local\Temp\transferencia rápida_____________________________________________________.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\transferencia rápida_____________________________________________________.bat.exe"
      2⤵
        PID:4568
      • C:\Users\Admin\AppData\Local\Temp\transferencia rápida_____________________________________________________.bat.exe
        "C:\Users\Admin\AppData\Local\Temp\transferencia rápida_____________________________________________________.bat.exe"
        2⤵
          PID:4572
        • C:\Users\Admin\AppData\Local\Temp\transferencia rápida_____________________________________________________.bat.exe
          "C:\Users\Admin\AppData\Local\Temp\transferencia rápida_____________________________________________________.bat.exe"
          2⤵
          • Drops file in Drivers directory
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:4560

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Email Collection

      1
      T1114

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\transferencia rápida_____________________________________________________.bat.exe.log
        MD5

        f1181bc4bdff57024c4121f645548332

        SHA1

        d431ee3a3a5afcae2c4537b1d445054a0a95f6e6

        SHA256

        f1a7e138b25d0cb24bb4b23bd781b0dd357afd49d45e19ffa44cdb80170336ad

        SHA512

        cf8059f289bcb4f33e82a2c4851fade486bd449793a39718d49bc357efd09689150aedd277c5ebcf79b5ebb4bbe36f0cbb72510a50398bee804ffd9c889604e3

        Download Submit
      • memory/4384-122-0x0000000005060000-0x0000000005061000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4384-124-0x0000000005AA0000-0x0000000005B0A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/4384-119-0x0000000004A80000-0x0000000004B12000-memory.dmp
        Filesize

        584KB

        Download
      • memory/4384-120-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4384-121-0x0000000005050000-0x0000000005058000-memory.dmp
        Filesize

        32KB

        Download
      • memory/4384-115-0x0000000000260000-0x0000000000261000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4384-123-0x0000000005900000-0x0000000005901000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4384-118-0x0000000004B20000-0x0000000004B21000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4384-117-0x00000000050E0000-0x00000000050E1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4560-126-0x000000000043773E-mapping.dmp
        Download
      • memory/4560-125-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/4560-132-0x0000000002740000-0x0000000002741000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4560-133-0x0000000005220000-0x0000000005221000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4560-134-0x00000000059E0000-0x00000000059E1000-memory.dmp
        Filesize

        4KB

        Download