Overview

overview

10

Static

static

3

RE KRMU664...df.exe

windows7-x64

10

RE KRMU664...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2023 16:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe

  • Size

    611KB

  • MD5

    beaa0809a41f302ef5fe63f8ff33dc7c

  • SHA1

    a35a921038cd3fbfd9be5dbeecb810b509c8af44

  • SHA256

    d46e1ec4fd88c836e0f27060808c2506e0df5d1034f9c88e56dd37bfc2113120

  • SHA512

    7a50094e704bd5b7855d2f9a1591fc5bede16702b60eaebfd1308fd9f103c97cbc870e1a59669d30e1a7b300ab14a68c1eb29790a8f0d574ec45f05d7744c4b9

  • SSDEEP

    12288:5Nj5AyzfpNHju4KJLwWk4yNAV8kYRz/Mf4QoCRn3AAztGSYzSwIp+muvuB1/2:53/NHadJLwWcNAmkYRDmn3z0SYzSXSuL

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5494052141:AAF2aO4sQ_tu4BOnk0pmxB995km7Mslduy0/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1860
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BIfqBYtWZCWdQZ.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:960
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BIfqBYtWZCWdQZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC582.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:896
    • C:\Users\Admin\AppData\Local\Temp\RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe"
      2⤵
        PID:1436
      • C:\Users\Admin\AppData\Local\Temp\RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\RE KRMU6644555 - TUTICORIN _YMHG 4th PO#QSB-180211, QSB-1802102 & GSB-18021992 .pdf.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:612

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpC582.tmp
      Filesize

      1KB

      MD5

      62cd75fc51314730e1ad32bfadc90514

      SHA1

      b870a7a737b16fe7167361f4ac790a4c5f72db0f

      SHA256

      3da1d683811ed7efd6a4f916cc615051fd9d35faf0a5f4b60686671bbcf5ce30

      SHA512

      1ec9b5b9009d6c6d351c0b8c063cf0d75ac940e7e6e249c26c85607503c6b9de202400c1c35c09243175f778cd5ca61a38f07449ee7a56fc08bb2d5e6cfe5f0d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KPZU8ZG55M6VEHUY6EK7.temp
      Filesize

      7KB

      MD5

      40134daeffebda6b552520edd5b516ac

      SHA1

      f1d7dbb744650b23df2d9c03693c59bbd54cfc59

      SHA256

      7632339252c2686ab230ce3a070678594b000159f742d101431fd77c86682680

      SHA512

      24e49b5fbdb4b47cbee2d8b77d40ef70c6196d8e3806bf2acdc338030245eebb118d60c893bc331c665a41da40a36fe243e77a194db64400954e3245ee624907

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      40134daeffebda6b552520edd5b516ac

      SHA1

      f1d7dbb744650b23df2d9c03693c59bbd54cfc59

      SHA256

      7632339252c2686ab230ce3a070678594b000159f742d101431fd77c86682680

      SHA512

      24e49b5fbdb4b47cbee2d8b77d40ef70c6196d8e3806bf2acdc338030245eebb118d60c893bc331c665a41da40a36fe243e77a194db64400954e3245ee624907

      Download Submit

    • memory/612-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/612-82-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/612-80-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/612-78-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/612-75-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/612-76-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/612-74-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/612-73-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/960-83-0x00000000026C0000-0x0000000002700000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1716-72-0x0000000004FF0000-0x000000000502E000-memory.dmp

      Filesize

      248KB

      Download

    • memory/1716-55-0x0000000004A30000-0x0000000004A70000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1716-56-0x00000000005B0000-0x00000000005C2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/1716-57-0x0000000004A30000-0x0000000004A70000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1716-54-0x0000000000B70000-0x0000000000C10000-memory.dmp

      Filesize

      640KB

      Download

    • memory/1716-58-0x00000000005D0000-0x00000000005DA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1716-59-0x0000000005F20000-0x0000000005F98000-memory.dmp

      Filesize

      480KB

      Download

    • memory/1860-84-0x00000000026B0000-0x00000000026F0000-memory.dmp

      Filesize

      256KB

      Download