Overview

overview

10

Static

static

SecuriteIn...65.exe

windows7-x64

10

SecuriteIn...65.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2022 12:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe

  • Size

    929KB

  • MD5

    f64f729e0ba974c578afaac25665e067

  • SHA1

    d1225322fd5f16eb18a90ec4a4b007a010e2d51a

  • SHA256

    680f16527c5dc7e7e32bb27b99dcbc85c75282d853cb9a27c186963dae883d2e

  • SHA512

    6bf0f4a2567736cdfa5e422e23f1f43a593699a1276654264a619e2f1b4690af911e04508d0928c3a84ea658c022dc4b44f4f0467254c72bb92191e212e029c8

  • SSDEEP

    12288:kBuqU+PCH5W8IgKprPRibKTh6SoqZpK3tUjjAK7nYbSuSmFbWNHrDdzoa1cfN:Idrlf6SoqbK3InYUJDdEPf

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5796842243:AAESM2w0ubqts6zEsE_xN4PZ56pLfxQ9e7M/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UmpBcHBDbXhaX.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:768
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UmpBcHBDbXhaX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D61.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1676
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1D61.tmp
    Filesize

    1KB

    MD5

    a7061eee34834f96731a44e7709ce0ee

    SHA1

    8e9900c489bf6dd1c4b18c35f37e78d384609896

    SHA256

    f9a260b349ce6bc4d477037dae7849ffeff4d4ed6806aeb65e3544f664351f04

    SHA512

    ed7a3d5067680a3437c42552fbd225e3d506ba7f5c971a3f72a4d8077133b78741dca711be5f8a19a29ef2f0db6442361c2da3187b1e5db43f1d1149df85f970

    Download Submit
  • memory/560-64-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/560-74-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/560-72-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/560-70-0x000000000043775E-mapping.dmp
    Download
  • memory/560-69-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/560-65-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/560-67-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/560-68-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/768-76-0x000000006E690000-0x000000006EC3B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/768-59-0x0000000000000000-mapping.dmp
    Download
  • memory/768-77-0x000000006E690000-0x000000006EC3B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1676-61-0x0000000000000000-mapping.dmp
    Download
  • memory/2020-58-0x0000000005290000-0x000000000532A000-memory.dmp
    Filesize

    616KB

    Download
  • memory/2020-63-0x0000000005330000-0x0000000005392000-memory.dmp
    Filesize

    392KB

    Download
  • memory/2020-54-0x0000000000B00000-0x0000000000BEE000-memory.dmp
    Filesize

    952KB

    Download
  • memory/2020-57-0x00000000004F0000-0x00000000004FE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/2020-56-0x00000000003D0000-0x00000000003E6000-memory.dmp
    Filesize

    88KB

    Download
  • memory/2020-55-0x0000000075451000-0x0000000075453000-memory.dmp
    Filesize

    8KB

    Download