Overview

overview

10

Static

static

SecuriteIn...15.exe

windows7-x64

10

SecuriteIn...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    69s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2022 06:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.6315.exe

  • Size

    956KB

  • MD5

    00e06c2981dd2a4ec8e53896e0876e6a

  • SHA1

    35a356a072aeb0037dd043d62bff09daf079d121

  • SHA256

    54e61eb93543f595d8589d7b09ef0a1286e238d58f6ae7a8001b0f73ca09d79e

  • SHA512

    45a580dc8309f9ad4434dec5d56b49679e1727d8dbc5676e9a9838aa391f22a4ff09e046723ea7795142deaba1b37135c4a131d349b01349e1d84fb556fd7488

  • SSDEEP

    12288:3bRwp6J6xdgZ8Uqcoz5pX6yZy4hdULM1W9Cl86dggxC02Iwo:3bwQQgZjqcouy44hcDtJIJ

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.hussain-co.com
  • Port:
    587
  • Username:
    finance@hussain-co.com
  • Password:
    %%finance_@2018%

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6315.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6315.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YUataZwY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp73D9.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1772
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6315.exe
      "{path}"
      2⤵
        PID:956
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6315.exe
        "{path}"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1872

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    3
    T1005

    Email Collection

    1
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp73D9.tmp
      Filesize

      1KB

      MD5

      523e2d96c0a1757c7fc4101062393dd4

      SHA1

      915f365cc9daa31403fe0eedc9fa3b365e83e151

      SHA256

      44359033c0f328e8bfc8c75d02d92b1a39fe2639c09e056e4bfafb23b7fb1823

      SHA512

      f36597a8acf7b30d203f1d9dc366fc446d50d3e7c6f9bfe816d321e521feec8dd81f0cb792a29a8adbe1e885ed0e40ebeea57e0cb915430d4990fe0c70309864

      Download Submit
    • memory/1772-59-0x0000000000000000-mapping.dmp
      Download
    • memory/1872-64-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1872-61-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1872-62-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1872-65-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1872-66-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1872-67-0x00000000004358FE-mapping.dmp
      Download
    • memory/1872-69-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1872-71-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1920-57-0x0000000004960000-0x00000000049DA000-memory.dmp
      Filesize

      488KB

      Download
    • memory/1920-58-0x0000000004EC0000-0x0000000004EFA000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1920-56-0x00000000004F0000-0x0000000000510000-memory.dmp
      Filesize

      128KB

      Download
    • memory/1920-55-0x00000000763F1000-0x00000000763F3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1920-54-0x0000000001190000-0x0000000001284000-memory.dmp
      Filesize

      976KB

      Download