Overview

overview

10

Static

static

DraftSwift...02.exe

windows7_x64

10

DraftSwift...02.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    182s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 00:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe

  • Size

    642KB

  • MD5

    a56bb0b32e1cf8a6d446ef50b4b22d90

  • SHA1

    458d0d9b4a210e34e958e2806700a5b177ddd660

  • SHA256

    6de5c4939b3168487631c164ffc007b883acc005f689fb91951a06b92b06ea27

  • SHA512

    09be55f3cc24410aaff2e100ce78bd61780f7eac62e310dcab23798cfcf13c316452749c759ab5fd7ca676158552089af82053e25426b67004f237987e281ed4

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.rebu.co.rw/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    o^Z0CIU?^yL2

  • Protocol:     ftp
  • Host:
    ftp://ftp.rebu.co.rw/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    o^Z0CIU?^yL2

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe
    "C:\Users\Admin\AppData\Local\Temp\DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe
      "{path}"
      2⤵
        PID:1524
      • C:\Users\Admin\AppData\Local\Temp\DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe
        "{path}"
        2⤵
          PID:952
        • C:\Users\Admin\AppData\Local\Temp\DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe
          "{path}"
          2⤵
            PID:936
          • C:\Users\Admin\AppData\Local\Temp\DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe
            "{path}"
            2⤵
            • Accesses Microsoft Outlook profiles
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • outlook_office_path
            • outlook_win_path
            PID:1320
            • C:\Windows\SysWOW64\netsh.exe
              "netsh" wlan show profile
              3⤵
                PID:1172

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Privilege Escalation

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials in Files

          2
          T1081

          Discovery

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Email Collection

          1
          T1114

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1172-71-0x0000000000000000-mapping.dmp
            Download
          • memory/1320-64-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

            Download
          • memory/1320-59-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

            Download
          • memory/1320-60-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

            Download
          • memory/1320-62-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

            Download
          • memory/1320-63-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

            Download
          • memory/1320-65-0x000000000044CF0E-mapping.dmp
            Download
          • memory/1320-67-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

            Download
          • memory/1320-69-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

            Download
          • memory/1944-56-0x0000000000630000-0x0000000000638000-memory.dmp
            Filesize

            32KB

            Download
          • memory/1944-57-0x0000000004E10000-0x0000000004E8A000-memory.dmp
            Filesize

            488KB

            Download
          • memory/1944-58-0x00000000045A0000-0x00000000045FC000-memory.dmp
            Filesize

            368KB

            Download
          • memory/1944-54-0x0000000000240000-0x00000000002E6000-memory.dmp
            Filesize

            664KB

            Download
          • memory/1944-55-0x00000000759F1000-0x00000000759F3000-memory.dmp
            Filesize

            8KB

            Download