Overview

overview

10

Static

static

3

SecuriteIn...32.exe

windows7-x64

10

SecuriteIn...32.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-03-2024 11:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.3432.exe

  • Size

    743KB

  • MD5

    e3bc5ff15300d968af348f4746ea5545

  • SHA1

    79d3c5548f60547513ee6c7df880593687c8f0da

  • SHA256

    0409163681798c7dc104320e5cc50a45826e1aac81b858fb426779745f322d3a

  • SHA512

    68a215479513fea9b98467cdadebc470860046484912981ab567a5a6ab9f17d814c41f9a6b11fefe83176ecf613f977902517fd77d2790e05bee40dc02a38240

  • SSDEEP

    12288:FYwEygw0UnKKekspijqztW6ouKjNuiFe6uKJHdWLtHb6N5xHe6OxvvY:Fqjiek2i606vKDFeWL2Hb6rx+6IvY

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.3432.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.3432.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.3432.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2632
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DaEGldW.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2520
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DaEGldW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D9F.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2120
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:2412

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp8D9F.tmp
      Filesize

      1KB

      MD5

      77d585e8064ff3d4dcf1a63f29e14747

      SHA1

      e5cba43092fac06a4a58e489c8a40d974702ccaf

      SHA256

      337124f9a3914b73c886d9d36baa711f1a4b6eccda6ce8d691aacb1e3013d619

      SHA512

      d7d7e5f0379063c20e36cd1b4c67170a514c00d7a1ebdb0128eeeb0ef4ea604c6ee619ea4e8c3a881d6a5f92ae1a9ca1dfcb7a85403434ac7e9476f2aa3c6db0

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      d2b396eaddcf07bbcdf01816695cee03

      SHA1

      42da2dbc968ee88dc6c89e100444cd35b638ed4b

      SHA256

      e091de88d7cdb4774e2bfe9f60d74c0c091a7975caf8f74dff21db02744f4ee2

      SHA512

      2109fdb40a9991da997be7234657c3dfd34a27fa50e55aafe086bb7d6be119609c2a24b4282d1e78a8bc9bfb9d7545fe0f5926a4cb8f4e04cac9f11960e9cbc7

      Download Submit
    • memory/2224-41-0x0000000004FD0000-0x0000000005010000-memory.dmp
      Filesize

      256KB

      Download
    • memory/2224-40-0x0000000074940000-0x000000007502E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2224-4-0x0000000000400000-0x000000000040C000-memory.dmp
      Filesize

      48KB

      Download
    • memory/2224-5-0x0000000004F10000-0x0000000004F92000-memory.dmp
      Filesize

      520KB

      Download
    • memory/2224-2-0x0000000004FD0000-0x0000000005010000-memory.dmp
      Filesize

      256KB

      Download
    • memory/2224-1-0x0000000074940000-0x000000007502E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2224-0-0x00000000013A0000-0x0000000001460000-memory.dmp
      Filesize

      768KB

      Download
    • memory/2224-3-0x00000000002A0000-0x00000000002B2000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2412-18-0x0000000000400000-0x0000000000442000-memory.dmp
      Filesize

      264KB

      Download
    • memory/2412-21-0x0000000000400000-0x0000000000442000-memory.dmp
      Filesize

      264KB

      Download
    • memory/2412-37-0x0000000000400000-0x0000000000442000-memory.dmp
      Filesize

      264KB

      Download
    • memory/2412-25-0x0000000000400000-0x0000000000442000-memory.dmp
      Filesize

      264KB

      Download
    • memory/2412-29-0x0000000000400000-0x0000000000442000-memory.dmp
      Filesize

      264KB

      Download
    • memory/2412-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2520-36-0x0000000002830000-0x0000000002870000-memory.dmp
      Filesize

      256KB

      Download
    • memory/2520-31-0x000000006F810000-0x000000006FDBB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2520-24-0x0000000002830000-0x0000000002870000-memory.dmp
      Filesize

      256KB

      Download
    • memory/2520-39-0x000000006F810000-0x000000006FDBB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2520-22-0x000000006F810000-0x000000006FDBB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2632-33-0x00000000022D0000-0x0000000002310000-memory.dmp
      Filesize

      256KB

      Download
    • memory/2632-28-0x000000006F810000-0x000000006FDBB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2632-26-0x000000006F810000-0x000000006FDBB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2632-34-0x00000000022D0000-0x0000000002310000-memory.dmp
      Filesize

      256KB

      Download
    • memory/2632-38-0x000000006F810000-0x000000006FDBB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2632-19-0x000000006F810000-0x000000006FDBB000-memory.dmp
      Filesize

      5.7MB

      Download