Overview

overview

10

Static

static

10

71037728dd...bc.exe

windows7_x64

10

71037728dd...bc.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    155s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    08-02-2022 11:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe

  • Size

    888KB

  • MD5

    b420cd9c5eefe5c4b1a80958476ceef2

  • SHA1

    ec9bad3fe35f25be002005011bbec029af4db4dd

  • SHA256

    71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc

  • SHA512

    13b43f836e34385003aef7074f355100481ddf46ab556f4094ee0cef0b8ef4233d90e83579b8ef15d63e91648d9e62271f91fafe40e9e69e1885430bb9aadb2a

Score
10/10
agentteslaneshtacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://nanyainc.cf/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    7qB+iH=KrUUT

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • AgentTesla Payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe
    "C:\Users\Admin\AppData\Local\Temp\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Users\Admin\AppData\Local\Temp\3582-490\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Users\Admin\AppData\Local\Temp\3582-490\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4220
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1936
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4296

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe.log
    MD5

    cf02a49bbd8d4586927e5fee38ae54da

    SHA1

    2802d8e79eed9911b39d2ae70fc6bdf7e1a7e605

    SHA256

    8be9b278ad090d0bc8fcc098c7289d782ae86240f69220d7d7175e38be892ec4

    SHA512

    542649eaec7089a89fa34c70d2a60d5b80ff4437125f5b69c70763e65b9a10bac01b786509ccc54c3e18e9c2acf306b24463fee611cfc137b6e9889c35162205

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3582-490\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe
    MD5

    933f2b5b95fbf6ebd96edf95112018ad

    SHA1

    e63bfa99a18f1e370727a005b092aafac7b2a398

    SHA256

    6d816af5a10da2892d27023b1ef0d9b47da019e102e56ab8e6943421279f41e9

    SHA512

    fbbcb9a3801b39e0647e5f30d33321f94d83b5ec4047089a2b93b93cb6ac4a116a77f62f38a86820c93427d0e4181d33ccc4b003c15bcac1a0f9d7e62b89999e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3582-490\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe
    MD5

    933f2b5b95fbf6ebd96edf95112018ad

    SHA1

    e63bfa99a18f1e370727a005b092aafac7b2a398

    SHA256

    6d816af5a10da2892d27023b1ef0d9b47da019e102e56ab8e6943421279f41e9

    SHA512

    fbbcb9a3801b39e0647e5f30d33321f94d83b5ec4047089a2b93b93cb6ac4a116a77f62f38a86820c93427d0e4181d33ccc4b003c15bcac1a0f9d7e62b89999e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3582-490\71037728ddcea1b094b4bc48fa92b2a0895f009f17e0e9354a3dc5fb0077e8bc.exe
    MD5

    933f2b5b95fbf6ebd96edf95112018ad

    SHA1

    e63bfa99a18f1e370727a005b092aafac7b2a398

    SHA256

    6d816af5a10da2892d27023b1ef0d9b47da019e102e56ab8e6943421279f41e9

    SHA512

    fbbcb9a3801b39e0647e5f30d33321f94d83b5ec4047089a2b93b93cb6ac4a116a77f62f38a86820c93427d0e4181d33ccc4b003c15bcac1a0f9d7e62b89999e

    Download Submit
  • memory/1144-134-0x0000000005650000-0x00000000056E2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/1144-132-0x0000000000B40000-0x0000000000C1A000-memory.dmp
    Filesize

    872KB

    Download
  • memory/1144-136-0x00000000055C0000-0x00000000055CA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1144-137-0x00000000055D0000-0x00000000055D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1144-146-0x0000000007AE0000-0x0000000007B7C000-memory.dmp
    Filesize

    624KB

    Download
  • memory/1144-135-0x0000000073910000-0x00000000740C0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1144-133-0x0000000005C00000-0x00000000061A4000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/1936-138-0x0000021F88770000-0x0000021F88780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1936-145-0x0000021F8B4F0000-0x0000021F8B4F4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/4220-147-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/4220-150-0x0000000073910000-0x00000000740C0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/4220-151-0x00000000056B0000-0x0000000005C54000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/4220-152-0x0000000006550000-0x00000000065B6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/4220-153-0x0000000001790000-0x00000000017E0000-memory.dmp
    Filesize

    320KB

    Download