Overview

overview

10

Static

static

po no 1038...er.exe

windows7_x64

10

po no 1038...er.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    155s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 01:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    po no 10389 & 10390 - for 2 orders together.exe

  • Size

    660KB

  • MD5

    3e68b7ef28a3025b722831cd624cb2a8

  • SHA1

    e176e6b0a34ecc203f30813e54a1ab8325297ab3

  • SHA256

    37e399fce2caa80c9ea931f693b51a6d1c11464df1ead916cfca67f6100ad71f

  • SHA512

    31fde62880b3e11a97832e09173231a2f0b9fe035cf04b705fd658be6439b7ffe16711e4fb1b2226b3dd440c1c7bbbcd243f4795cec03c34f8cc6e80edcaf857

Score
10/10
agentteslacollectionevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    gnaeask@2015

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\po no 10389 & 10390 - for 2 orders together.exe
    "C:\Users\Admin\AppData\Local\Temp\po no 10389 & 10390 - for 2 orders together.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xbhONTmkRh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B03.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4224
    • C:\Users\Admin\AppData\Local\Temp\po no 10389 & 10390 - for 2 orders together.exe
      "C:\Users\Admin\AppData\Local\Temp\po no 10389 & 10390 - for 2 orders together.exe"
      2⤵
        PID:2960
      • C:\Users\Admin\AppData\Local\Temp\po no 10389 & 10390 - for 2 orders together.exe
        "C:\Users\Admin\AppData\Local\Temp\po no 10389 & 10390 - for 2 orders together.exe"
        2⤵
          PID:4900
        • C:\Users\Admin\AppData\Local\Temp\po no 10389 & 10390 - for 2 orders together.exe
          "C:\Users\Admin\AppData\Local\Temp\po no 10389 & 10390 - for 2 orders together.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:2356

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp2B03.tmp
        Filesize

        1KB

        MD5

        976fbfb4811da72141698ae8f27a79ea

        SHA1

        6e423a66a725721adcf0463e35965be356cd96df

        SHA256

        230b321d4955a373b8223f3329fd7d9731fb1da3dd7d8b6cbd8170deba0bd5fd

        SHA512

        de67c8d498e7f968e7d74c9d6e650831d896be7adf8a430cf084a99d7e45d7d8085f61c9f6c96c54bbbb0fdbf0d345dbad97e5f71c3e15fc90c2ee239eb369ee

        Download Submit

      • memory/2356-143-0x0000000006B40000-0x0000000006B90000-memory.dmp

        Filesize

        320KB

        Download

      • memory/2356-142-0x0000000000400000-0x0000000000458000-memory.dmp

        Filesize

        352KB

        Download

      • memory/2356-141-0x0000000000000000-mapping.dmp

        Download

      • memory/2960-139-0x0000000000000000-mapping.dmp

        Download

      • memory/4224-137-0x0000000000000000-mapping.dmp

        Download

      • memory/4896-133-0x0000000005220000-0x00000000052B2000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4896-136-0x00000000056C0000-0x0000000005726000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4896-135-0x0000000005410000-0x0000000005466000-memory.dmp

        Filesize

        344KB

        Download

      • memory/4896-134-0x0000000005160000-0x000000000516A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4896-130-0x0000000000690000-0x000000000073C000-memory.dmp

        Filesize

        688KB

        Download

      • memory/4896-132-0x0000000005730000-0x0000000005CD4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4896-131-0x00000000050A0000-0x000000000513C000-memory.dmp

        Filesize

        624KB

        Download

      • memory/4900-140-0x0000000000000000-mapping.dmp

        Download