Overview

overview

10

Static

static

SecuriteIn...12.exe

windows7-x64

10

SecuriteIn...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06-12-2022 13:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe

  • Size

    885KB

  • MD5

    cfd49eaec7f6ae012aad21687a52a311

  • SHA1

    8ca719076e105c04f9f2c0a9a1e6d08c08dd3840

  • SHA256

    4d7089ed0ea37bffbf210a1178cceab8b97ea2775d2d7efd478272c50374fde7

  • SHA512

    c5756acc9fe06ea224c2385d2c4b37c1244919935a173b532d3ee2aba23c071d3c58708b8fd0cda518cb160e0bcfc29c5018ca55a3cf680fbfc4bcec22e2869f

  • SSDEEP

    12288:BwlXfmomPZefnRftvbw6snXQNEwO0QDNag0G6VPkEz88GBkt6IiaxRoPa3Ptqvyd:RomxinR9bw3b04Nr0DV8ksK6u3QF/N

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.symmdentaesthetics.com/
  • Port:
    21
  • Username:
    [email protected]/
  • Password:
    smartooo@12

  • Protocol:     ftp
  • Host:
    ftp://ftp.symmdentaesthetics.com/
  • Port:
    21
  • Username:
    [email protected]/
  • Password:
    smartooo@12

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla payload 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NcJlKP.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:588
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NcJlKP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBF4A.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:524
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe"
      2⤵
        PID:1972

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpBF4A.tmp
      Filesize

      1KB

      MD5

      0063914d9b9e057561097b1229faa513

      SHA1

      80add6e9452d597545f1afed13c9a06b6f5fd012

      SHA256

      d3ef112d6f2dd87280a31394fb733f69ca492f0ce0d584273c72e8c9b841f9b3

      SHA512

      4ef0b91923912ce3faaa97e5cbf9cf15310f0c96750e2996311f69cff7a152ec490798894ee6c508e722c6a6141f438548adadf11b63643af14c49cf27243d3a

      Download Submit
    • memory/524-60-0x0000000000000000-mapping.dmp
      Download
    • memory/588-59-0x0000000000000000-mapping.dmp
      Download
    • memory/588-77-0x000000006E740000-0x000000006ECEB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/588-76-0x000000006E740000-0x000000006ECEB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/1360-63-0x0000000004F50000-0x0000000004FAA000-memory.dmp
      Filesize

      360KB

      Download
    • memory/1360-58-0x0000000007D40000-0x0000000007DD2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1360-57-0x0000000000350000-0x000000000035E000-memory.dmp
      Filesize

      56KB

      Download
    • memory/1360-54-0x00000000001B0000-0x0000000000294000-memory.dmp
      Filesize

      912KB

      Download
    • memory/1360-55-0x0000000075091000-0x0000000075093000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1360-56-0x0000000000370000-0x000000000038A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/1972-68-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/1972-67-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/1972-69-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/1972-70-0x0000000000447D8E-mapping.dmp
      Download
    • memory/1972-72-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/1972-74-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/1972-65-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/1972-64-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

      Download