Overview

overview

10

Static

static

2f3a8a7c3b...5a.exe

windows7_x64

10

2f3a8a7c3b...5a.exe

windows10-2004_x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-06-2022 23:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f3a8a7c3b690511b284328d72b0ec17733f158b998b4e46c9fa5a12aadfa65a.exe

  • Size

    1003KB

  • MD5

    9cac744095b6f061f0d4a1ae1d06de94

  • SHA1

    cee4c0bb627929baa9e9fe2f3d124862e04a96a1

  • SHA256

    2f3a8a7c3b690511b284328d72b0ec17733f158b998b4e46c9fa5a12aadfa65a

  • SHA512

    dbd7cc51f9a16ad28de4ccbe41f8d90a71d51f07d9eea8f761b97adf31df3f237035623c3cf4d3d304776e8d621ecfb432ea8ec1188e3c7cb057a63eac6859c9

Score
10/10
collectionpersistencespywarestealersuricata

Malware Config

Signatures

  • suricata: ET MALWARE AgentTesla Communicating with CnC Server

    suricata: ET MALWARE AgentTesla Communicating with CnC Server

    suricata
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f3a8a7c3b690511b284328d72b0ec17733f158b998b4e46c9fa5a12aadfa65a.exe
    "C:\Users\Admin\AppData\Local\Temp\2f3a8a7c3b690511b284328d72b0ec17733f158b998b4e46c9fa5a12aadfa65a.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/880-54-0x0000000075711000-0x0000000075713000-memory.dmp
    Filesize

    8KB

    Download
  • memory/880-55-0x0000000073FD0000-0x000000007457B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/880-56-0x0000000073FD0000-0x000000007457B000-memory.dmp
    Filesize

    5.7MB

    Download