Overview

overview

10

Static

static

5

0fcd3484d2...4b.exe

windows7_x64

10

0fcd3484d2...4b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    04-06-2022 14:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0fcd3484d291bf5d9ac474cdc0fb448d8bb61e63beb87201d9b3bf6c4d96cf4b.exe

  • Size

    1.3MB

  • MD5

    e11a22c0d8fdac1626d1a94866906cd9

  • SHA1

    95a56cfb56a8704ba8533321a4c56c846ed3431c

  • SHA256

    0fcd3484d291bf5d9ac474cdc0fb448d8bb61e63beb87201d9b3bf6c4d96cf4b

  • SHA512

    0d570f48f7ad28ebe0c444a72e63dd200b9883ae0704b3571b98fe4e2962489751b1395bc670e1e04f68ceb92eb9bf5f6284c89a67449c69843efd56bdbc31f3

Score
10/10
agentteslaneshtakeyloggerpersistencespywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • AgentTesla Payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fcd3484d291bf5d9ac474cdc0fb448d8bb61e63beb87201d9b3bf6c4d96cf4b.exe
    "C:\Users\Admin\AppData\Local\Temp\0fcd3484d291bf5d9ac474cdc0fb448d8bb61e63beb87201d9b3bf6c4d96cf4b.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Users\Admin\AppData\Local\Temp\3582-490\0fcd3484d291bf5d9ac474cdc0fb448d8bb61e63beb87201d9b3bf6c4d96cf4b.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\0fcd3484d291bf5d9ac474cdc0fb448d8bb61e63beb87201d9b3bf6c4d96cf4b.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
        3⤵
          PID:4880

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Change Default File Association

    1
    T1042

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3582-490\0fcd3484d291bf5d9ac474cdc0fb448d8bb61e63beb87201d9b3bf6c4d96cf4b.exe
      Filesize

      1.3MB

      MD5

      e129667c9517c7d894be1adf0146acfc

      SHA1

      2828046d9a77446764f0bb5a643aab68c4157636

      SHA256

      af001f40eea4a8f93963b9b10c8001856cc0d4037462f34108157fe1fb2d3f83

      SHA512

      5f433ca98acf45d0b581655538d9e5085fc03cdc2ded5ef7bafc2262f4853c2dcb3b66ff432fad2bbf9259091e0698d1310eda46061f10a568a1673545921a9b

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\3582-490\0fcd3484d291bf5d9ac474cdc0fb448d8bb61e63beb87201d9b3bf6c4d96cf4b.exe
      Filesize

      1.3MB

      MD5

      e129667c9517c7d894be1adf0146acfc

      SHA1

      2828046d9a77446764f0bb5a643aab68c4157636

      SHA256

      af001f40eea4a8f93963b9b10c8001856cc0d4037462f34108157fe1fb2d3f83

      SHA512

      5f433ca98acf45d0b581655538d9e5085fc03cdc2ded5ef7bafc2262f4853c2dcb3b66ff432fad2bbf9259091e0698d1310eda46061f10a568a1673545921a9b

      Download Submit
    • memory/2260-130-0x0000000000000000-mapping.dmp
      Download
    • memory/4880-133-0x0000000000000000-mapping.dmp
      Download
    • memory/4880-134-0x0000000000400000-0x0000000000458000-memory.dmp
      Filesize

      352KB

      Download
    • memory/4880-139-0x0000000072EE0000-0x0000000073491000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/4880-140-0x00000000723E0000-0x0000000072EE0000-memory.dmp
      Filesize

      11.0MB

      Download
    • memory/4880-141-0x0000000071A90000-0x0000000072238000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/4880-142-0x0000000072EE0000-0x0000000073491000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/4880-143-0x00000000723E0000-0x0000000072EE0000-memory.dmp
      Filesize

      11.0MB

      Download