Overview

overview

10

Static

static

overdue ac...DF.exe

windows7_x64

10

overdue ac...DF.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 02:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    overdue account letter.PDF.exe

  • Size

    433KB

  • MD5

    9bc66f36baedd02eb6b55e391d90b324

  • SHA1

    aaa6786ed70237361fb28250da350181d0fd28fe

  • SHA256

    4b1a13f1b1a0bff19df63d1ebf93a2c1c390896b77db3b724a2e5c03f6007d81

  • SHA512

    027dbf3d56939ad0d7f4bae865863e9da23d3be4278b2e7a257b8c08b135390322b298c4bece43cda407c6eeec07c4f41a5d5b72bcee4018c65b6530aa3f462e

Score
10/10
agentteslaevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.microtechlab.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    pune@123

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\overdue account letter.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\overdue account letter.PDF.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\myhqZugPIlg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp346E.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:424
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Drops file in Drivers directory
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Windows\SysWOW64\REG.exe
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
        • Modifies registry key
        PID:320
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:2136
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1596
          3⤵
          • Program crash
          PID:2960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1548 -ip 1548
      1⤵
        PID:3152

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Modify Registry

      2
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp346E.tmp
        Filesize

        1KB

        MD5

        f8e870ce6c57069d0a3265717d955cb6

        SHA1

        91bd7306dba616adcf40cd553aa191c5d39ba7c7

        SHA256

        a299218941cd0460c5f5730e9d3ba87e64046d3efc0028e1f6885995a8920c36

        SHA512

        ec5cca7c4a3d889235a95be8a503e7b68bacc23a82c7d0ff9bb1f4dcf7a67cb3e4e277da58c8b43dd3926270e12286e363031a05783910512b320bdb2eeada92

        Download Submit
      • memory/320-139-0x0000000000000000-mapping.dmp
        Download
      • memory/424-134-0x0000000000000000-mapping.dmp
        Download
      • memory/1548-136-0x0000000000000000-mapping.dmp
        Download
      • memory/1548-137-0x0000000000400000-0x0000000000452000-memory.dmp
        Filesize

        328KB

        Download
      • memory/1548-138-0x0000000005690000-0x00000000056F6000-memory.dmp
        Filesize

        408KB

        Download
      • memory/1548-140-0x0000000000D20000-0x0000000000D70000-memory.dmp
        Filesize

        320KB

        Download
      • memory/2136-141-0x0000000000000000-mapping.dmp
        Download
      • memory/3144-130-0x0000000000290000-0x0000000000302000-memory.dmp
        Filesize

        456KB

        Download
      • memory/3144-131-0x0000000004FF0000-0x000000000508C000-memory.dmp
        Filesize

        624KB

        Download
      • memory/3144-132-0x0000000005130000-0x00000000051C2000-memory.dmp
        Filesize

        584KB

        Download
      • memory/3144-133-0x0000000005F60000-0x0000000006504000-memory.dmp
        Filesize

        5.6MB

        Download