Overview

overview

10

Static

static

3

895665fab2...a0.exe

windows7-x64

10

895665fab2...a0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-03-2024 02:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe

  • Size

    705KB

  • MD5

    f82eef7cd2d0ec1cd2f0553388d9366a

  • SHA1

    afd08cfd931b0fb2a1746f6c676d21f108ca8d56

  • SHA256

    895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0

  • SHA512

    5b41a5f69da5be06d7e6c59f5755f546b5bc8368bd3f04be9ef8aaab019325122d854d36c8aeed88b242a5751e51b3703e12a9ec495adc06b1ada8f3f73a3ad9

  • SSDEEP

    12288:oMoK1a5W4ZXyPftg8bVEM6weJENAbJs8W4DOWKmaliyWIDDKsx7wDusXU4O8S5:HkXyNtbreJ7JhtDOWZaEy3KawDusE8Q

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs
  • Detects executables packed with SmartAssembly 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe
    "C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe
      "C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe"
      2⤵
        PID:2556
      • C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe
        "C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe"
        2⤵
          PID:2632
        • C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe
          "C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe"
          2⤵
            PID:2636
          • C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe
            "C:\Users\Admin\AppData\Local\Temp\895665fab2e077f4ac46cc0e9ebbf5e84da4a851c163320734cfd39f3916bba0.exe"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2668

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Unsecured Credentials

        4
        T1552

        Credentials In Files

        3
        T1552.001

        Credentials in Registry

        1
        T1552.002

        Discovery

        Lateral Movement

        Collection

        Data from Local System

        4
        T1005

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1544-0-0x0000000000150000-0x0000000000206000-memory.dmp
          Filesize

          728KB

          Download
        • memory/1544-1-0x0000000074920000-0x000000007500E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/1544-2-0x0000000004C70000-0x0000000004CB0000-memory.dmp
          Filesize

          256KB

          Download
        • memory/1544-3-0x0000000000360000-0x0000000000372000-memory.dmp
          Filesize

          72KB

          Download
        • memory/1544-4-0x00000000004F0000-0x00000000004FC000-memory.dmp
          Filesize

          48KB

          Download
        • memory/1544-5-0x00000000054A0000-0x0000000005522000-memory.dmp
          Filesize

          520KB

          Download
        • memory/1544-17-0x0000000074920000-0x000000007500E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/2668-9-0x0000000000400000-0x0000000000440000-memory.dmp
          Filesize

          256KB

          Download
        • memory/2668-7-0x0000000000400000-0x0000000000440000-memory.dmp
          Filesize

          256KB

          Download
        • memory/2668-8-0x0000000000400000-0x0000000000440000-memory.dmp
          Filesize

          256KB

          Download
        • memory/2668-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2668-12-0x0000000000400000-0x0000000000440000-memory.dmp
          Filesize

          256KB

          Download
        • memory/2668-14-0x0000000000400000-0x0000000000440000-memory.dmp
          Filesize

          256KB

          Download
        • memory/2668-16-0x0000000000400000-0x0000000000440000-memory.dmp
          Filesize

          256KB

          Download
        • memory/2668-18-0x0000000074920000-0x000000007500E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/2668-6-0x0000000000400000-0x0000000000440000-memory.dmp
          Filesize

          256KB

          Download
        • memory/2668-19-0x0000000004BE0000-0x0000000004C20000-memory.dmp
          Filesize

          256KB

          Download