Overview

overview

10

Static

static

SecuriteIn...48.exe

windows7-x64

10

SecuriteIn...48.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    89s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06-12-2022 06:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Inject4.48217.5038.20848.exe

  • Size

    852KB

  • MD5

    4b3cfdb34766e74f6cd23457413e472b

  • SHA1

    89b2cdd54219e372faeb511b6c5db80b73a268fe

  • SHA256

    7317c534293832125834e4620b4b25eee69673d74205a8355c84e155225c558c

  • SHA512

    5c8d5c116fc36cd376e090409b612d1b6a1bd015015e37fe60f6747a8e822b634238ced0a1ddb5bf5abd5778089fb7bce679553f5f51c5d2f2fb4d37e7c10123

  • SSDEEP

    12288:2ck+ySNerfWwSFZZYEkQl40+xvFDA4p/70KGB6jmaZgKZ/nXt7virmWhlGLaQYI:Nk+ySYfjSrZYnSti9A4p/7sw

Score
10/10
agentteslaevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.huiijingco.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    lNLUrZT2

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla payload 6 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.48217.5038.20848.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.48217.5038.20848.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.48217.5038.20848.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1764
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.48217.5038.20848.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.48217.5038.20848.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:368

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/368-68-0x0000000000436C5E-mapping.dmp
    Download
  • memory/368-63-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/368-62-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/368-70-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/368-66-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/368-72-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/368-67-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/368-65-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/968-58-0x00000000055D0000-0x0000000005650000-memory.dmp
    Filesize

    512KB

    Download
  • memory/968-55-0x0000000075501000-0x0000000075503000-memory.dmp
    Filesize

    8KB

    Download
  • memory/968-56-0x0000000000430000-0x0000000000446000-memory.dmp
    Filesize

    88KB

    Download
  • memory/968-61-0x0000000005170000-0x00000000051B8000-memory.dmp
    Filesize

    288KB

    Download
  • memory/968-54-0x0000000000CD0000-0x0000000000DAC000-memory.dmp
    Filesize

    880KB

    Download
  • memory/968-57-0x0000000000450000-0x000000000045E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1764-59-0x0000000000000000-mapping.dmp
    Download
  • memory/1764-73-0x000000006F0F0000-0x000000006F69B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1764-74-0x000000006F0F0000-0x000000006F69B000-memory.dmp
    Filesize

    5.7MB

    Download