Overview

overview

10

Static

static

0372YT5914...df.exe

windows7-x64

10

0372YT5914...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    109s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2022, 11:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0372YT591445-22 -33,000-EUR-SWIFT MESAJI.pdf.exe

  • Size

    1.0MB

  • MD5

    7d1ce33dd0b35916568574bc74bdd9ec

  • SHA1

    ae301f0385186c4b471c5fdb81ba867fabcb4005

  • SHA256

    dea123120680cd1e4b53ed10ad4b6be99792c0d2847652edc4f7bb5e0eaa3c7b

  • SHA512

    039da908c27be7c199134b69a60d081e3b94e85d6b6130e9605efb87978c63c81ccd9982f0d235aefe571f44faff7dc0e42a2359d06841e7252b072c89f368a1

  • SSDEEP

    12288:k0uI/f2CWjxdgKhkR/3z3q018CcGc44OmTv/mytaS10/9YR4bJ8dFY4Hs:1Xu/dgnR/iCQO6F8adu4M

Score
10/10
agentteslacollectionevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0372YT591445-22 -33,000-EUR-SWIFT MESAJI.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\0372YT591445-22 -33,000-EUR-SWIFT MESAJI.pdf.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0372YT591445-22 -33,000-EUR-SWIFT MESAJI.pdf.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1324
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xicxzJPS.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xicxzJPS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB55C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:600
    • C:\Users\Admin\AppData\Local\Temp\0372YT591445-22 -33,000-EUR-SWIFT MESAJI.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\0372YT591445-22 -33,000-EUR-SWIFT MESAJI.pdf.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:2000

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpB55C.tmp
          Filesize

          1KB

          MD5

          6f2e04bfe7800fa2a9c25322eb16532d

          SHA1

          8fb28dfa67efe76dd74ea154b5469fbe435e1a10

          SHA256

          9a2b128ff7b80ebfa517b0bd3146982f711dc41572ec66fddcae0d2e8baaa0c1

          SHA512

          038aa75bd969830473bfe51c60e3c75de405919c718092fe8a065c895596e0b1a797b7ae552a236e23807fba1e10ed012e86a51aaefdcc5846bee18856160343

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
          Filesize

          7KB

          MD5

          5fd7dcd1e5edfa6dee70d856042de34f

          SHA1

          233456657c34fc01f5dd2f84b522573cea26c496

          SHA256

          5e05bb9c1d683f9cbb0bc341ced7bea4e325a4be5ff406a8d4e3b9ad8afcb5da

          SHA512

          4e3a1e59433b4b0f5afef6f62ac990fc7d1a7e0683d1da1965fe767bc31a44af8baa9e88c9bd53f48370c67fd3817ae1f5a838b2cfd914b9606d794131754ca0

          Download Submit

        • memory/1044-55-0x0000000075071000-0x0000000075073000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1044-56-0x0000000000460000-0x0000000000476000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1044-57-0x0000000000480000-0x000000000048C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/1044-58-0x0000000004F00000-0x0000000004FB6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/1044-54-0x0000000000860000-0x000000000096C000-memory.dmp

          Filesize

          1.0MB

          Download

        • memory/1044-67-0x00000000060D0000-0x0000000006150000-memory.dmp

          Filesize

          512KB

          Download

        • memory/1160-80-0x000000006EA50000-0x000000006EFFB000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1160-81-0x000000006EA50000-0x000000006EFFB000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1324-61-0x000000006EA50000-0x000000006EFFB000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1324-82-0x000000006EA50000-0x000000006EFFB000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2000-69-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

          Download

        • memory/2000-71-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

          Download

        • memory/2000-72-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

          Download

        • memory/2000-73-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

          Download

        • memory/2000-76-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

          Download

        • memory/2000-78-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

          Download

        • memory/2000-68-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

          Download