Overview

overview

10

Static

static

commercial...8L.exe

windows7-x64

10

commercial...8L.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    93s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    commercial invoice-AD1-2001028L.exe

  • Size

    6KB

  • MD5

    8d936312a59afa52e18a4d665755690d

  • SHA1

    aa34c27cdf073eb5c54e371714d3d68a626bbbd8

  • SHA256

    ee511bade3822feb689576b65cb3e490e9459c11c5b6583b36920f742c1bd99d

  • SHA512

    b36924fe5af405e6447fbf01d6d9c75cfe9dc335e36b64ea8982e59a1d9ac48dde4855f5c84cdcc21fb4d4dcbbfca1e485bbd32f04b10d67c1dc577aab9abd65

  • SSDEEP

    96:awqkGAzKfGe7DVys+BWfik85EOd/vSGQeMFnU:N4DUDEPYEOdES

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\commercial invoice-AD1-2001028L.exe
    "C:\Users\Admin\AppData\Local\Temp\commercial invoice-AD1-2001028L.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA3AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:780
    • C:\Users\Admin\AppData\Local\Temp\commercial invoice-AD1-2001028L.exe
      "C:\Users\Admin\AppData\Local\Temp\commercial invoice-AD1-2001028L.exe"
      2⤵
        PID:536
      • C:\Users\Admin\AppData\Local\Temp\commercial invoice-AD1-2001028L.exe
        "C:\Users\Admin\AppData\Local\Temp\commercial invoice-AD1-2001028L.exe"
        2⤵
          PID:1500
        • C:\Users\Admin\AppData\Local\Temp\commercial invoice-AD1-2001028L.exe
          "C:\Users\Admin\AppData\Local\Temp\commercial invoice-AD1-2001028L.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • outlook_office_path
          • outlook_win_path
          PID:1100

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Email Collection

      1
      T1114

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/780-61-0x000000006DEB0000-0x000000006E45B000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/780-59-0x000000006DEB0000-0x000000006E45B000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/780-60-0x000000006DEB0000-0x000000006E45B000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/780-57-0x0000000000000000-mapping.dmp
        Download
      • memory/1100-63-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/1100-62-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/1100-65-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/1100-67-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/1100-66-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/1100-68-0x0000000000437F4E-mapping.dmp
        Download
      • memory/1100-70-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/1100-72-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/1600-56-0x0000000005790000-0x00000000059AA000-memory.dmp
        Filesize

        2.1MB

        Download
      • memory/1600-55-0x00000000752B1000-0x00000000752B3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1600-54-0x0000000000300000-0x0000000000308000-memory.dmp
        Filesize

        32KB

        Download