Overview

overview

10

Static

static

3

Fiyat tekl...10.exe

windows7-x64

10

Fiyat tekl...10.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01-06-2023 10:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe

  • Size

    747KB

  • MD5

    d5d197b61c8f4dc96530d345ef16e410

  • SHA1

    ab14341e4f7570c14ded8b5ce2cf1d7e23db8d3c

  • SHA256

    a5e39f16cb3dec0b3e2b6fe876bbfa1805f2266011289cf24864b3b85d9e5561

  • SHA512

    a42353aa2d72e7c22da54f214377fce7ffd26e40aa4c142f7449439a0e68ec35e2e8158603ed99d000fb014200fb7e6a1776064d6a6cd0e202723002d264ea44

  • SSDEEP

    12288:nnAMTihh6xhZ6OrEjKPrkUi0+jTp2kZWqYdMLw1AShBkMETtOpAARED1SGimFJKT:AMUgh8yOxvTjt2kc5aUW+BetW4R/iKc

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe
    "C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:332
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XCqiOgxHrZ.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:868
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XCqiOgxHrZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE48.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2004
    • C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe
      "C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe"
      2⤵
        PID:2020
      • C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe
        "C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe"
        2⤵
          PID:1036
        • C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe
          "C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe"
          2⤵
            PID:1316
          • C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe
            "C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe"
            2⤵
              PID:1144
            • C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe
              "C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi Istegi_23051609051 ürun Etiket scan0010.exe"
              2⤵
              • Accesses Microsoft Outlook profiles
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: RenamesItself
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • outlook_office_path
              • outlook_win_path
              PID:1500

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmpCE48.tmp
            Filesize

            1KB

            MD5

            1e99649c5b1fb86023b51c249871926d

            SHA1

            cf7e280395ded11663539b3f277a57989dafb60d

            SHA256

            dfc9da830251557ec84a478633f8121f666494b7e7b120481ed456ebf1541ff2

            SHA512

            22fd1f5a03bef4b705c3d590d837feaf913edec5f19d7548c13bbe2afc4a2aa05a74689a5dbd59971299e81e21a88dd3aeb9e5b22060900f46ef5543dd7718dc

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q9RR8YS07R1VD0K38TT7.temp
            Filesize

            7KB

            MD5

            ed59f4608496b65a706f94cce2fbc1b0

            SHA1

            9771df2aac2b7abe5c635d0ad1cb471022b520c1

            SHA256

            9e4f664e131db918ffdfad7e7cc283323fb5a44fc38ff1e0a2eaa4fcd7d73188

            SHA512

            95da03cbcd682466996bd4f18b9cbfdffc4f0fd0fb1f1b69c808c3ddd4690ea539547a7fa3f3ff327a9157965fb9a0bcdee8353363772f45dda84c1e3ba3227e

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
            Filesize

            7KB

            MD5

            ed59f4608496b65a706f94cce2fbc1b0

            SHA1

            9771df2aac2b7abe5c635d0ad1cb471022b520c1

            SHA256

            9e4f664e131db918ffdfad7e7cc283323fb5a44fc38ff1e0a2eaa4fcd7d73188

            SHA512

            95da03cbcd682466996bd4f18b9cbfdffc4f0fd0fb1f1b69c808c3ddd4690ea539547a7fa3f3ff327a9157965fb9a0bcdee8353363772f45dda84c1e3ba3227e

            Download Submit

          • memory/332-83-0x0000000002280000-0x00000000022C0000-memory.dmp

            Filesize

            256KB

            Download

          • memory/1500-73-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

            Download

          • memory/1500-74-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

            Download

          • memory/1500-87-0x0000000002000000-0x0000000002040000-memory.dmp

            Filesize

            256KB

            Download

          • memory/1500-82-0x0000000002000000-0x0000000002040000-memory.dmp

            Filesize

            256KB

            Download

          • memory/1500-81-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

            Download

          • memory/1500-72-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

            Download

          • memory/1500-79-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

            Download

          • memory/1500-75-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

            Download

          • memory/1500-77-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

            Download

          • memory/1500-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1928-58-0x0000000005510000-0x0000000005586000-memory.dmp

            Filesize

            472KB

            Download

          • memory/1928-54-0x00000000001E0000-0x00000000002A0000-memory.dmp

            Filesize

            768KB

            Download

          • memory/1928-71-0x0000000004FC0000-0x0000000004FFE000-memory.dmp

            Filesize

            248KB

            Download

          • memory/1928-56-0x0000000000620000-0x0000000000634000-memory.dmp

            Filesize

            80KB

            Download

          • memory/1928-55-0x0000000004D80000-0x0000000004DC0000-memory.dmp

            Filesize

            256KB

            Download

          • memory/1928-57-0x0000000001E10000-0x0000000001E1C000-memory.dmp

            Filesize

            48KB

            Download