Overview

overview

10

Static

static

3

SecuriteIn...54.exe

windows7-x64

10

SecuriteIn...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2023, 07:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win64.PWSX-gen.24801.25754.exe

  • Size

    32KB

  • MD5

    ee4bbc4739a0fc1c8fbac11cc1f63385

  • SHA1

    13f7d950881ebd77bdde2afda6781d02c2c97ddb

  • SHA256

    c12de4a53b633a610834e274d0d1abb8304f8e184694c6a777ab461fcd89c9ff

  • SHA512

    f010aa774a61a5fd088a281094a2742308be8a9b9196f90cca5a9a479e09f26917f9c7bff43833b37b68be416fbc5a0b4292c64b4e47de1df76486679932a1fb

  • SSDEEP

    768:HcIIkYpBiTkETf0hR0lvKNdZwF1Jc2SW2YVmuYfU:9ZYpBKkbhR09F1JbSW2YVmpfU

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.24801.25754.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.24801.25754.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
      2⤵
        PID:5116
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
        2⤵
          PID:3832
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
          2⤵
            PID:3984
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
            2⤵
              PID:928
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
              2⤵
                PID:4020
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
                2⤵
                  PID:4160
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
                  2⤵
                    PID:704
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
                    2⤵
                      PID:3116
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                      2⤵
                        PID:4104
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
                        2⤵
                          PID:4748
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
                          2⤵
                            PID:2348
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                            2⤵
                              PID:2228
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
                              2⤵
                                PID:1756
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
                                2⤵
                                  PID:4592
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
                                  2⤵
                                    PID:4552
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
                                    2⤵
                                      PID:4212
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
                                      2⤵
                                        PID:3920
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
                                        2⤵
                                          PID:216
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
                                          2⤵
                                            PID:4376
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
                                            2⤵
                                              PID:1456
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
                                              2⤵
                                              • Accesses Microsoft Outlook profiles
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • outlook_office_path
                                              • outlook_win_path
                                              PID:440

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • memory/440-143-0x00000000065C0000-0x0000000006782000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/440-137-0x0000000000400000-0x0000000000430000-memory.dmp

                                            Filesize

                                            192KB

                                            Download

                                          • memory/440-139-0x00000000053B0000-0x0000000005954000-memory.dmp

                                            Filesize

                                            5.6MB

                                            Download

                                          • memory/440-140-0x0000000004EC0000-0x0000000004F26000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/440-141-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/440-142-0x00000000063A0000-0x00000000063F0000-memory.dmp

                                            Filesize

                                            320KB

                                            Download

                                          • memory/440-144-0x0000000006490000-0x0000000006522000-memory.dmp

                                            Filesize

                                            584KB

                                            Download

                                          • memory/440-145-0x0000000006440000-0x000000000644A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/440-146-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1128-134-0x0000022D5EAE0000-0x0000022D5EB56000-memory.dmp

                                            Filesize

                                            472KB

                                            Download

                                          • memory/1128-135-0x0000022D5ECB0000-0x0000022D5ECC0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1128-136-0x0000022D449F0000-0x0000022D44A0E000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/1128-133-0x0000022D44640000-0x0000022D4464C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download