Overview

overview

10

Static

static

Fa-200000345.exe

windows7_x64

10

Fa-200000345.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 14:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fa-200000345.exe

  • Size

    974KB

  • MD5

    7789215ed9d6d730fb242791151786ea

  • SHA1

    a911fb8e9f323561f202f58cb26f177a5b7eef72

  • SHA256

    13c555d2bc29bc384b7c496c0aefadfbe38d7b415e11c43bdbcfdf702062d1f3

  • SHA512

    b49cbc134c1e612b7e861e2528ea282980b9cb9a8d109cb3f9ce37b94e76565874da3d19ae88f92be2f917889909feaddad925193f69743564a6f18648586905

Score
10/10
agentteslaxpertratcollectionevasionkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.salsabile.com
  • Port:
    587
  • Username:
    recep.mag.mp@salsabile.com
  • Password:
    @SALSA@2015

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.salsabile.com
  • Port:
    587
  • Username:
    recep.mag.mp@salsabile.com
  • Password:
    @SALSA@2015

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • UAC bypass 3 TTPs
    evasiontrojan
  • Windows security bypass 2 TTPs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • AgentTesla Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fa-200000345.exe
    "C:\Users\Admin\AppData\Local\Temp\Fa-200000345.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Users\Admin\AppData\Local\Temp\ATT&T.exe
      "C:\Users\Admin\AppData\Local\Temp\ATT&T.exe"
      2⤵
      • Executes dropped EXE
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1808
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\ATT&T.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          4⤵
            PID:2060
      • C:\Users\Admin\AppData\Local\Temp\Fa-200000345.exe
        "C:\Users\Admin\AppData\Local\Temp\Fa-200000345.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2172
      • C:\Users\Admin\AppData\Local\Temp\Fa-200000345.exe
        "C:\Users\Admin\AppData\Local\Temp\Fa-200000345.exe" 2 2172 240553343
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3200

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    2
    T1060

    Privilege Escalation

    Bypass User Account Control

    1
    T1088

    Defense Evasion

    Bypass User Account Control

    1
    T1088

    Disabling Security Tools

    3
    T1089

    Modify Registry

    6
    T1112

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Data from Local System

    3
    T1005

    Email Collection

    1
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ATT&T.exe
      Filesize

      172KB

      MD5

      cb8c55e28fd767032af22d370232fdcf

      SHA1

      d7b9b352c2bf2fd24dbff8594d14312cf1b01b2c

      SHA256

      c3b001c5b7cc76d1bcf9fbb26c98fec1d577029e68379342b0d5ee00be163a27

      SHA512

      3136ad9fba23f9bd786863079a71c560cd4b4d3b2713955b853053ba97233b75de97bac6963a136e4397707407e395130e6bcf490fef8276a3bb0b05eaf21540

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\ATT&T.exe
      Filesize

      172KB

      MD5

      cb8c55e28fd767032af22d370232fdcf

      SHA1

      d7b9b352c2bf2fd24dbff8594d14312cf1b01b2c

      SHA256

      c3b001c5b7cc76d1bcf9fbb26c98fec1d577029e68379342b0d5ee00be163a27

      SHA512

      3136ad9fba23f9bd786863079a71c560cd4b4d3b2713955b853053ba97233b75de97bac6963a136e4397707407e395130e6bcf490fef8276a3bb0b05eaf21540

      Download Submit
    • memory/1808-131-0x0000000000000000-mapping.dmp
      Download
    • memory/2060-141-0x0000000000000000-mapping.dmp
      Download
    • memory/2172-135-0x0000000000000000-mapping.dmp
      Download
    • memory/2172-137-0x0000000000920000-0x000000000097A000-memory.dmp
      Filesize

      360KB

      Download
    • memory/2172-139-0x0000000000920000-0x000000000097A000-memory.dmp
      Filesize

      360KB

      Download
    • memory/2172-142-0x0000000074A50000-0x0000000075001000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/3200-136-0x0000000000000000-mapping.dmp
      Download
    • memory/3200-140-0x0000000000400000-0x00000000004F9000-memory.dmp
      Filesize

      996KB

      Download
    • memory/3704-130-0x0000000000400000-0x00000000004F9000-memory.dmp
      Filesize

      996KB

      Download