Overview

overview

10

Static

static

3

808dc37ef5...04.exe

windows7-x64

10

808dc37ef5...04.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2023 13:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    808dc37ef54a4c95bb66f4773d8a84d9b6f548b00bae26ee514996a7f46d2a04.exe

  • Size

    666KB

  • MD5

    e81d3a6286beea59a2fe264b2b4ee156

  • SHA1

    acbff15ea6b56cb04810e826bfb555b5c2b7efae

  • SHA256

    808dc37ef54a4c95bb66f4773d8a84d9b6f548b00bae26ee514996a7f46d2a04

  • SHA512

    5239f0f66a3d2b2855d104ebd2e4f3f30766a7fb04f1fc4c6d93139f43ee3e8befd6fd2043d1bcd5a3860af96f0527fb7e784162fbc32367fcb27da80db27d6b

  • SSDEEP

    12288:1hkZ59iBJMCZyGzhurolUfjc+gcqjma5G9lvxx4ALiKOsFNKwV8RjnHG0VRp+yzl:1K/9i/XZ3zhurUX+dkma5G99xLLiKOK8

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.siscop.com.co
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    +5s48Ia2&-(t

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\808dc37ef54a4c95bb66f4773d8a84d9b6f548b00bae26ee514996a7f46d2a04.exe
    "C:\Users\Admin\AppData\Local\Temp\808dc37ef54a4c95bb66f4773d8a84d9b6f548b00bae26ee514996a7f46d2a04.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2944-0-0x0000000001030000-0x00000000010DC000-memory.dmp

    Filesize

    688KB

    Download

  • memory/2944-1-0x0000000074190000-0x000000007487E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2944-2-0x0000000000A70000-0x0000000000AB0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2944-3-0x00000000003C0000-0x00000000003DA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2944-4-0x00000000003E0000-0x00000000003E8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2944-5-0x00000000005B0000-0x00000000005BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2944-6-0x00000000052E0000-0x000000000535E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/2944-7-0x00000000004F0000-0x0000000000532000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2944-8-0x0000000074190000-0x000000007487E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2944-9-0x0000000000A70000-0x0000000000AB0000-memory.dmp

    Filesize

    256KB

    Download