Overview

overview

10

Static

static

T.T.Remitt...le.exe

windows7_x64

10

T.T.Remitt...le.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    108s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 01:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    T.T.Remittance schedule.exe

  • Size

    633KB

  • MD5

    89f103f080f90d7254cfbef4332e8153

  • SHA1

    6cc38d5131e33dac4e3d276186ecc6c8cba549ca

  • SHA256

    9075d56174383d598e32b3d10e6cfbad3599b7db8a1478f4a55d3067f4c05e8d

  • SHA512

    c016716864496b2db57b76f37ac41a65dfea7799b195a7f966a7ae2d849d1e6438eb99a31d0db402d2101fc04e54a0f54fb9afb8aa1e3df55cf63767080417c3

Score
10/10
agentteslacollectionevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    company1960

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    company1960

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\T.T.Remittance schedule.exe
    "C:\Users\Admin\AppData\Local\Temp\T.T.Remittance schedule.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\coRqIpPhQFPQV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C90.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4044
    • C:\Users\Admin\AppData\Local\Temp\T.T.Remittance schedule.exe
      "{path}"
      2⤵
        PID:4072
      • C:\Users\Admin\AppData\Local\Temp\T.T.Remittance schedule.exe
        "{path}"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4700

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\T.T.Remittance schedule.exe.log
      Filesize

      1KB

      MD5

      5db726e67dbb0e7ce0f11ee0799c44fd

      SHA1

      e3bfb90ae6b7b02ca26bd08fe7f253350196a61e

      SHA256

      2f55491428d6f770a0f1e1e2eb49e0ecfcf78c30403fee75f886bd99031f7d33

      SHA512

      6ebee129cf303f000b8e8df6f320f5209604aca4c258c69b7374c814b2ba5266c868ccbe894ef7212d7125eacc9fbe4d3634b7b0d51e893f8d296cf0fd7d32f3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp1C90.tmp
      Filesize

      1KB

      MD5

      a034fc7c1d215eafc526260764bd6ca9

      SHA1

      96a24172cef1176d213b052f84d7a654188545d5

      SHA256

      921470afdb215bb5f3bec7c794fc3f5d6aad1a4a99ba31523dd293cec504e3d9

      SHA512

      999038d0f7ba586ec349e910b94a60c29aa48cefd84aae36dcb8014649678d9d78646c8a68310dc631eaac2f12689e1e8a74cc326b71819b4a4b3e71078fa136

      Download Submit

    • memory/3116-131-0x0000000005EE0000-0x0000000006484000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/3116-132-0x0000000005A10000-0x0000000005AA2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/3116-133-0x00000000059E0000-0x00000000059EA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3116-134-0x0000000010480000-0x000000001051C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/3116-135-0x0000000010520000-0x0000000010586000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3116-130-0x0000000000F90000-0x0000000001034000-memory.dmp

      Filesize

      656KB

      Download

    • memory/4044-136-0x0000000000000000-mapping.dmp

      Download

    • memory/4072-138-0x0000000000000000-mapping.dmp

      Download

    • memory/4700-139-0x0000000000000000-mapping.dmp

      Download

    • memory/4700-140-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/4700-142-0x0000000006B50000-0x0000000006BA0000-memory.dmp

      Filesize

      320KB

      Download