Overview

overview

10

Static

static

1fd944afc5...99.exe

windows7_x64

10

1fd944afc5...99.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    15-04-2022 01:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1fd944afc5fbcea802725291874169d93bf8c38317c20f2b088343a177e06499.exe

  • Size

    533KB

  • MD5

    d798664cee72c14f64667fb9a2453945

  • SHA1

    77c8bc80447612eb309a46191a512fac392d1b1b

  • SHA256

    1fd944afc5fbcea802725291874169d93bf8c38317c20f2b088343a177e06499

  • SHA512

    0a0922e097d1491deaa2e957ebc14cdf87155037df5290ee1469d5057e31c0517d7b3f9f8e76b63e036ce232679a4dc7218c5f1642279bc501ba5435a2978dc1

Score
10/10
agentteslametastealercollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer
  • AgentTesla Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fd944afc5fbcea802725291874169d93bf8c38317c20f2b088343a177e06499.exe
    "C:\Users\Admin\AppData\Local\Temp\1fd944afc5fbcea802725291874169d93bf8c38317c20f2b088343a177e06499.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\slvmevdXCbt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC5F.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2560
    • C:\Users\Admin\AppData\Local\Temp\1fd944afc5fbcea802725291874169d93bf8c38317c20f2b088343a177e06499.exe
      "{path}"
      2⤵
        PID:2468
      • C:\Users\Admin\AppData\Local\Temp\1fd944afc5fbcea802725291874169d93bf8c38317c20f2b088343a177e06499.exe
        "{path}"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2188

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1fd944afc5fbcea802725291874169d93bf8c38317c20f2b088343a177e06499.exe.log
      Filesize

      1KB

      MD5

      6f8f3a9a57cb30e686d3355e656031e0

      SHA1

      acccd6befb1a2f40e662280bc5182e086a0d079b

      SHA256

      283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

      SHA512

      8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmpFC5F.tmp
      Filesize

      1KB

      MD5

      b8917d697b182e8e51f6897ce239a208

      SHA1

      be400f1617004670c3cef4261a61c9ddab5cf8f4

      SHA256

      d7e110ec07e5b0a679a1b71e00cba7bd349e1b665446fe5a80535c53b6f9e034

      SHA512

      901d527eb9ae8902084e68b0ed201b962a24c9fc8a525406e48f221abd12559d70d488b240afb8abd8891e3d2a3b91f2a532d5a0cffa9904d3826af384e2454d

      Download Submit

    • memory/2188-143-0x00000000072F0000-0x0000000007340000-memory.dmp

      Filesize

      320KB

      Download

    • memory/2188-142-0x00000000066B0000-0x0000000006716000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2188-140-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

      Download

    • memory/3496-130-0x00000000007A0000-0x000000000082C000-memory.dmp

      Filesize

      560KB

      Download

    • memory/3496-135-0x0000000006A10000-0x0000000006AAC000-memory.dmp

      Filesize

      624KB

      Download

    • memory/3496-134-0x0000000006360000-0x000000000688C000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/3496-133-0x00000000051E0000-0x00000000051EA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3496-132-0x00000000052D0000-0x0000000005362000-memory.dmp

      Filesize

      584KB

      Download

    • memory/3496-131-0x0000000005880000-0x0000000005E24000-memory.dmp

      Filesize

      5.6MB

      Download