Overview

overview

10

Static

static

Cables Demand.exe

windows7_x64

10

Cables Demand.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    44s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 03:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Cables Demand.exe

  • Size

    416KB

  • MD5

    a6353cb228c5035a9ef68d475da91fe7

  • SHA1

    e3e70404c00beaa1185c50c49f3abf84ce9d887c

  • SHA256

    b977389b487ea178bc1ce4448a2a67c5f0a5d327a6c9500308574aa9945901df

  • SHA512

    31ed5cc5a9c1214baf69fdd29220ba0be0eb9ab8866041a6256f8e12eead7f7a16f846e923485417bd5cbf318a7d1bd8431ab6f682bccdb775e0d34bdb12c154

Score
10/10
agentteslacollectioncoreentitykeyloggerrezer0spywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity
  • AgentTesla Payload 1 IoCs
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cables Demand.exe
    "C:\Users\Admin\AppData\Local\Temp\Cables Demand.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:1944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1944-54-0x0000000000DE0000-0x0000000000E4E000-memory.dmp
    Filesize

    440KB

    Download
  • memory/1944-55-0x00000000753C1000-0x00000000753C3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1944-56-0x0000000000340000-0x0000000000348000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1944-57-0x0000000000A40000-0x0000000000A96000-memory.dmp
    Filesize

    344KB

    Download
  • memory/1944-58-0x0000000004D10000-0x0000000004D5E000-memory.dmp
    Filesize

    312KB

    Download