Overview

overview

10

Static

static

3e88c09381...5f.exe

windows7-x64

10

3e88c09381...5f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    55s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    08-12-2022 11:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3e88c09381a0adaafc96b14317c7bad84ff62380bb4bb220ca618153b2a29b5f.exe

  • Size

    469KB

  • MD5

    9cd5ea2d2fdc3f6a69d0c87be7a64c22

  • SHA1

    62b83c1c2f82185f2f62918e7b34d477c43b5fdc

  • SHA256

    3e88c09381a0adaafc96b14317c7bad84ff62380bb4bb220ca618153b2a29b5f

  • SHA512

    d4fe9b5b75b804b9ea9851a05f37b9f79cccf545e53c2c1e387bd1f69c31e2e84886796a5e4aa910744abd1121b76db055ec504ffc5652264b54799ebb7ebfbe

  • SSDEEP

    12288:SIkGAjyp8qqxzmWnwsXz9L2xRmfipJ19SHWFH8Pmrb:SIkGAmDq5mWwsXZeRmkogH8Pm3

Score
10/10
agentteslacollectionevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5482315235:AAGwacbjVLMaBQENAXUuPyVg-cvhlK0vn-w/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e88c09381a0adaafc96b14317c7bad84ff62380bb4bb220ca618153b2a29b5f.exe
    "C:\Users\Admin\AppData\Local\Temp\3e88c09381a0adaafc96b14317c7bad84ff62380bb4bb220ca618153b2a29b5f.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:624
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:1548

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Virtualization/Sandbox Evasion

    2
    T1497

    Credential Access

    Discovery

    Query Registry

    4
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    2
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Email Collection

    1
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1548-56-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1548-57-0x000000000043589E-mapping.dmp
      Download
    • memory/1548-59-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1548-61-0x0000000000400000-0x000000000043A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/1548-62-0x00000000758C1000-0x00000000758C3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1652-54-0x0000000000CD0000-0x0000000000D4A000-memory.dmp
      Filesize

      488KB

      Download
    • memory/1652-55-0x0000000000650000-0x00000000006C8000-memory.dmp
      Filesize

      480KB

      Download