Overview

overview

10

Static

static

32bacb18da...df.exe

windows7-x64

10

32bacb18da...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2022 13:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    32bacb18da76123bfd75161a2e792d38cbadf89dfefeb245fbcc7b23e1bce1df.exe

  • Size

    654KB

  • MD5

    9cc8e46f398bcc89b242a7787b3c0df6

  • SHA1

    22af4baa501611c0dd5aec4f8e4c4c57e6ed21a0

  • SHA256

    32bacb18da76123bfd75161a2e792d38cbadf89dfefeb245fbcc7b23e1bce1df

  • SHA512

    6add524c0379316ea51d0ed6f0a86e1b04c65208ad93d3bd9b4e17207ca646aab617285e519ffac94aea3ed1824567df416e209e501a9b190bf639461e90f163

  • SSDEEP

    12288:2ElYIvM3zrbETClx58SaQhXGqELhbI5pc8Hk3rBeHskFgFwIyXCDM:93U376C/58SI6cDbkskFgqIyXx

Score
10/10
agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32bacb18da76123bfd75161a2e792d38cbadf89dfefeb245fbcc7b23e1bce1df.exe
    "C:\Users\Admin\AppData\Local\Temp\32bacb18da76123bfd75161a2e792d38cbadf89dfefeb245fbcc7b23e1bce1df.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XTaZHrgkwkSprP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9483.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1796
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
        PID:672
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        2⤵
          PID:1848
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "{path}"
          2⤵
            PID:1052
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "{path}"
            2⤵
            • Accesses Microsoft Outlook profiles
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:1668

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Virtualization/Sandbox Evasion

        2
        T1497

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Query Registry

        4
        T1012

        Virtualization/Sandbox Evasion

        2
        T1497

        System Information Discovery

        3
        T1082

        Peripheral Device Discovery

        1
        T1120

        Lateral Movement

        Collection

        Email Collection

        1
        T1114

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp9483.tmp
          Filesize

          1KB

          MD5

          511001308db674cdabbb912efcc330b6

          SHA1

          020fb08454fdda94b38f6210afbfb3acc5028807

          SHA256

          716a9efe7305ad224870d76f47b54718501c361942e1b8fb7d6c7416ce7788a3

          SHA512

          9cae81326a8dfc688bbbbc853ca1f7584d849e7f922560f3a1bd581daa9a67f9ee0b08b7b445d366bd6ead4f6309806a7d9586f1236567a00b32441ef01295a8

          Download Submit
        • memory/1668-66-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/1668-67-0x0000000000437C4E-mapping.dmp
          Download
        • memory/1668-71-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/1668-69-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/1668-62-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/1668-64-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/1668-61-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/1668-65-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/1796-59-0x0000000000000000-mapping.dmp
          Download
        • memory/2032-54-0x0000000001090000-0x000000000113A000-memory.dmp
          Filesize

          680KB

          Download
        • memory/2032-55-0x0000000075881000-0x0000000075883000-memory.dmp
          Filesize

          8KB

          Download
        • memory/2032-56-0x0000000000490000-0x00000000004A2000-memory.dmp
          Filesize

          72KB

          Download
        • memory/2032-58-0x00000000008D0000-0x000000000090C000-memory.dmp
          Filesize

          240KB

          Download
        • memory/2032-57-0x0000000005270000-0x00000000052F2000-memory.dmp
          Filesize

          520KB

          Download