Overview

overview

10

Static

static

1

Copy#0700181203.exe

windows7-x64

10

Copy#0700181203.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Copy#0700181203.exe

  • Size

    307KB

  • MD5

    3a7ad7df17d52faa30c9267d8993c052

  • SHA1

    20babf125ffdc301bc7670817f8123af61ff0940

  • SHA256

    a3d1e36ffb22746489c9932108842ef58d71c86c5a01bade59d1f0f9cbe2fde4

  • SHA512

    6d7d7ea7a3310c7cc768556126f710d21f2dc500c5287613a35ba020a0b0ec5f85101c27068c2dc4ef94135e6228aec7501ceba123ebbd81891467ebfa37cbb8

  • SSDEEP

    3072:qvBGLqxexlS+I3lPE6MPYUNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbGgKk12g:qvwpkqBstvLGtELbMUTKZIH

Score
10/10
agentteslaxwormzgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    66.29.151.236
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    fn26k5c7Q846

Extracted

Family

agenttesla

Credentials

Extracted

Family

xworm

Version

5.0

C2

94.156.65.181:5353

Mutex

4EV9DEZhSiEuj72Q

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680

aes.plain

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 34 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Copy#0700181203.exe
    "C:\Users\Admin\AppData\Local\Temp\Copy#0700181203.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Users\Admin\AppData\Local\Temp\FB_1C1E.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\FB_1C1E.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4308
      • C:\Users\Admin\AppData\Local\Temp\FB_1EA0.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\FB_1EA0.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\FB_1C1E.tmp.exe
    Filesize

    234KB

    MD5

    06db36296ae61e019a6c6e717c94767b

    SHA1

    7a00c1ada2ad8ed153488ba9a761b76b94716cd2

    SHA256

    e3806f66f45cd3ab049bd762b7cb14c2c27ca7854221356d7681c239c510b3ab

    SHA512

    0db22d6c5ab97e827994b4998c7ac717b7421ce15c40eae6ec4d082df51232434cb408179268b9bc82ed4218c3c46dd79273f14071b692e2e412b6aa637b73ec

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\FB_1EA0.tmp.exe
    Filesize

    41KB

    MD5

    f334a1ac079415859e447dfe9581fcdb

    SHA1

    6c906d05d4fd5ca52c4661abd2a6ca00446a6d7d

    SHA256

    dc794a76f3d4644853d105b86586700c24d36c4bf0b13582209d22f651fa18f9

    SHA512

    bf9bf1317845f1e48ad31b138ca70dd8bd4b5acb96a01a3639adbe186b369a3c15bf4609ff79f8996b89158ac95986e26ecbbd40216e2a8e12b56457a949343d

    Download Submit
  • memory/1900-0-0x000000007464E000-0x000000007464F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1900-1-0x00000000008A0000-0x00000000008F0000-memory.dmp
    Filesize

    320KB

    Download
  • memory/1900-2-0x0000000074640000-0x0000000074DF0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1900-3-0x00000000073D0000-0x0000000007606000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-4-0x0000000007BB0000-0x0000000008154000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/1900-5-0x00000000076A0000-0x0000000007732000-memory.dmp
    Filesize

    584KB

    Download
  • memory/1900-6-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-15-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-37-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-59-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-61-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-65-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-69-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-67-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-63-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-57-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-55-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-53-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-51-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-49-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-47-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-45-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-43-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-41-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-39-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-35-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-33-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-31-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-29-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-25-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-23-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-21-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-17-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-13-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-11-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-9-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-7-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-27-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-19-0x00000000073D0000-0x0000000007600000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1900-4886-0x0000000074640000-0x0000000074DF0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1900-4887-0x0000000005F70000-0x0000000005FE2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1900-4888-0x0000000005A10000-0x0000000005A5C000-memory.dmp
    Filesize

    304KB

    Download
  • memory/1900-4889-0x000000007464E000-0x000000007464F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1900-4890-0x0000000074640000-0x0000000074DF0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1900-4891-0x0000000006150000-0x00000000061A4000-memory.dmp
    Filesize

    336KB

    Download
  • memory/1900-4900-0x0000000074640000-0x0000000074DF0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/2132-4924-0x0000000000D70000-0x0000000000D80000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4308-4920-0x0000000073A4E000-0x0000000073A4F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4308-4923-0x0000000000050000-0x0000000000090000-memory.dmp
    Filesize

    256KB

    Download
  • memory/4308-4925-0x0000000004AA0000-0x0000000004B06000-memory.dmp
    Filesize

    408KB

    Download
  • memory/4308-4926-0x00000000060F0000-0x0000000006140000-memory.dmp
    Filesize

    320KB

    Download
  • memory/4308-4927-0x00000000061E0000-0x000000000627C000-memory.dmp
    Filesize

    624KB

    Download
  • memory/4308-4928-0x00000000062B0000-0x00000000062BA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/4308-4929-0x0000000073A4E000-0x0000000073A4F000-memory.dmp
    Filesize

    4KB

    Download