Overview

overview

10

Static

static

KsoUkx8kQkhNBfv.exe

windows7_x64

10

KsoUkx8kQkhNBfv.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 02:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    KsoUkx8kQkhNBfv.exe

  • Size

    645KB

  • MD5

    97cd758a698d47b01edd4a3281503176

  • SHA1

    da997a6c3491c6a0a58c69aff6a630328dae4602

  • SHA256

    8bd67af43b81d9303bc114e81c598c9ae1cb4d55315c750ae3eea3691513c94f

  • SHA512

    0d85f512d7669543c0f6ce4337995533755e72d36ab673a43383491e2bc1c937e62e8433c4c90f9077701243061eaca02e0d399a26b1c2c10bb3e0fbe248ffab

Score
10/10
agentteslaevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    roham.dnswebhost.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    anyiego@123

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KsoUkx8kQkhNBfv.exe
    "C:\Users\Admin\AppData\Local\Temp\KsoUkx8kQkhNBfv.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BXXwfEloUhOLj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp773E.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4776
    • C:\Users\Admin\AppData\Local\Temp\KsoUkx8kQkhNBfv.exe
      "{path}"
      2⤵
        PID:3604
      • C:\Users\Admin\AppData\Local\Temp\KsoUkx8kQkhNBfv.exe
        "{path}"
        2⤵
          PID:4956
        • C:\Users\Admin\AppData\Local\Temp\KsoUkx8kQkhNBfv.exe
          "{path}"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2528

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Discovery

      Query Registry

      5
      T1012

      Virtualization/Sandbox Evasion

      2
      T1497

      System Information Discovery

      4
      T1082

      Peripheral Device Discovery

      1
      T1120

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp773E.tmp
        Filesize

        1KB

        MD5

        30a625542c9375bf32d5d9efeb8b8fd7

        SHA1

        5e234f01d733ad15069a1439da03f369bcec1dde

        SHA256

        d36fe32699a0ee59ad1e041673f0f0003dc5108626f73e8a28d2dc1cc8f22d8c

        SHA512

        c212eb194a944d1e4969b2669047240fbc66e2921d9ae7c07cd67331d7df01a1c7c85e0eea1bb703d4698611133f8039235099a3d2c95b66d7b5add9f93ff118

        Download Submit
      • memory/2528-135-0x0000000000000000-mapping.dmp
        Download
      • memory/2528-136-0x0000000000400000-0x0000000000466000-memory.dmp
        Filesize

        408KB

        Download
      • memory/2528-137-0x0000000074ED0000-0x0000000075481000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/3604-133-0x0000000000000000-mapping.dmp
        Download
      • memory/4188-130-0x0000000074ED0000-0x0000000075481000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/4776-131-0x0000000000000000-mapping.dmp
        Download
      • memory/4956-134-0x0000000000000000-mapping.dmp
        Download