Overview

overview

10

Static

static

10

f33535fb28...a7.exe

windows7-x64

10

f33535fb28...a7.exe

windows10-2004-x64

10

f3476b5441...96.exe

windows7-x64

10

f3476b5441...96.exe

windows10-2004-x64

10

f479112f0f...e2.msi

windows7-x64

7

f479112f0f...e2.msi

windows10-2004-x64

8

f64398ee74...a4.exe

windows7-x64

10

f64398ee74...a4.exe

windows10-2004-x64

10

f672ba8bf0...6f.exe

windows7-x64

10

f672ba8bf0...6f.exe

windows10-2004-x64

10

f92501ffd4...76.exe

windows7-x64

10

f92501ffd4...76.exe

windows10-2004-x64

10

fa20559cba...8e.exe

windows7-x64

10

fa20559cba...8e.exe

windows10-2004-x64

10

fa98feb0fc...05.exe

windows7-x64

7

fa98feb0fc...05.exe

windows10-2004-x64

7

fb1c133bb4...90.exe

windows7-x64

10

fb1c133bb4...90.exe

windows10-2004-x64

10

fbce724386...fe.exe

windows7-x64

10

fbce724386...fe.exe

windows10-2004-x64

10

fc82f1f187...54.exe

windows7-x64

10

fc82f1f187...54.exe

windows10-2004-x64

10

fd03ea32f5...54.exe

windows7-x64

7

fd03ea32f5...54.exe

windows10-2004-x64

7

fe21006be0...ea.exe

windows7-x64

10

fe21006be0...ea.exe

windows10-2004-x64

10

fe53c0822d...00.elf

debian-9-armhf

1

fe6b8e0d18...a4.exe

windows7-x64

10

fe6b8e0d18...a4.exe

windows10-2004-x64

10

ff53a80edb...60.bat

windows7-x64

7

ff53a80edb...60.bat

windows10-2004-x64

7

ffbd6ffb75...4e.exe

windows7-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10-10-2023 13:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fb1c133bb4d681619adff92051b62f07da505ca6f15906b4fbb125bd65b1f190.exe

  • Size

    575KB

  • MD5

    0dffc7074ad574b0748ef8e60a52f068

  • SHA1

    6c573e941701381625d10817496632994c83fd11

  • SHA256

    fb1c133bb4d681619adff92051b62f07da505ca6f15906b4fbb125bd65b1f190

  • SHA512

    0450dfc3562b3484c2482f44e1180e53cf6c6cee2cc93ad8ab6c723c6f7daf08ecc673b046feab6ecf30a5919c6a7a7c288d309f5ef43b585bd6f1e71658661b

  • SSDEEP

    12288:b37s93Kd3l4IrCUJQs7pBuguvAAuvjMHIzgzX0cGW:r7s96x+IrClPj9j

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb1c133bb4d681619adff92051b62f07da505ca6f15906b4fbb125bd65b1f190.exe
    "C:\Users\Admin\AppData\Local\Temp\fb1c133bb4d681619adff92051b62f07da505ca6f15906b4fbb125bd65b1f190.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kWbKwRQqX.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2720
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kWbKwRQqX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE032.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2608
    • C:\Users\Admin\AppData\Local\Temp\fb1c133bb4d681619adff92051b62f07da505ca6f15906b4fbb125bd65b1f190.exe
      "C:\Users\Admin\AppData\Local\Temp\fb1c133bb4d681619adff92051b62f07da505ca6f15906b4fbb125bd65b1f190.exe"
      2⤵
        PID:2764

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpE032.tmp
      Filesize

      1KB

      MD5

      5c72a683a18013e3f3960826e222d251

      SHA1

      0c6a2b3d4316679ad3023c8f93caca378549b927

      SHA256

      1b86d4a6e053b6fbad7746f2449ec2c248acf99032c75759c0e810c21e582bdd

      SHA512

      1b0b229f811e7a3b4eda0333026b7a5e67e384025f6b9d58f46de334ba9e0fe8e1fdd25dd1026b0df04562e0629fa2d754c04d7ae684b4b6b36866f0f56a9a20

      Download Submit

    • memory/2408-4-0x0000000074470000-0x0000000074B5E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2408-5-0x00000000044D0000-0x0000000004510000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2408-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2408-0-0x0000000000E20000-0x0000000000EB6000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2408-2-0x00000000044D0000-0x0000000004510000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2408-6-0x0000000000410000-0x0000000000420000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2408-7-0x0000000004F80000-0x0000000004FEA000-memory.dmp

      Filesize

      424KB

      Download

    • memory/2408-3-0x0000000000550000-0x0000000000568000-memory.dmp

      Filesize

      96KB

      Download

    • memory/2720-20-0x000000006EB10000-0x000000006F0BB000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2720-21-0x000000006EB10000-0x000000006F0BB000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2720-22-0x0000000002360000-0x00000000023A0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2720-23-0x0000000002360000-0x00000000023A0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2720-24-0x0000000002360000-0x00000000023A0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2720-25-0x000000006EB10000-0x000000006F0BB000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2764-16-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2764-15-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2764-13-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download