Analysis
-
max time kernel
196s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
22-11-2022 12:56
General
-
Target
SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe
-
Size
961KB
-
MD5
37ec92d6d742fadd1d398d92153bcf70
-
SHA1
e80d54c9b7bc5ea5dd717122a380ac62f631e532
-
SHA256
7b2c22135a593218b38f180ac6147283ef45f35965caacec43cfb4db3aead0c8
-
SHA512
2cf907a39b1f3aab74a5ce96f0c26839fd38c9edb476910baa66d42d48155a36a510eb7fe7c2193409eaf18f2b30411b56267700efe0fccb7132be625813ca3d
-
SSDEEP
12288:GqSSSgsEoLpvkoYyBLeNATTO56Cfp9PyUZvkOjkTwA6j9MvFnJh8uyrTSJeAzO4q:cbEwxfiNATqvx9P9WO1GvFJn+TyI48
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5303328165:AAF7HxnjN67EBIegVs-MwZqBsR_i0699CXE/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
886B
MD5737df710de5690e8dcf11cbac5a717bc
SHA1a0d04767b1b543f6634283519931927314cd35a5
SHA256537028f9a060bae450a8a7b2409ac4c14dc2732eecce1609bad8684411819406
SHA512508320eec49f7224afcf8b12a0d273928acc8bcbd3ba456e0a4128bf8ce4fd7e48390fb95369088eed93a3ffc03fe9cfd0b2f76ae3d138f0456d8be1d0497c7a
-
Filesize
432KB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
40KB
-
Filesize
984KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
624KB