Overview

overview

10

Static

static

1

216176b4eb...82.exe

windows7-x64

10

216176b4eb...82.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 01:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    216176b4ebbcf066ad142fb327e53c7765e60261ef13d4ec45bb02d0db117082.exe

  • Size

    893KB

  • MD5

    ed567007d635c168315c462b2366b9ce

  • SHA1

    4e95b7774838bb0521b4ff4bd149dc1b27f5c50e

  • SHA256

    216176b4ebbcf066ad142fb327e53c7765e60261ef13d4ec45bb02d0db117082

  • SHA512

    b8d580f3b5fc73f6d6eb5fa6b75a1eba2ca1ed020d731cd7d116c582681efe56d5ba0f79dade933dcb73cdecf9440b9f788933a571d1d2280478ccd9d52608d5

  • SSDEEP

    12288:ylYifTU6KiRpwR5vP7EgYsK4clfXVmSSO3ItJnsY3Haahj6EMJbOpDZzlwMSYvMy:Fi3KoGbEgxch4ptP3H9hj67ADz2c

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.medicalhome.com.pe
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    MHinfo01

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\216176b4ebbcf066ad142fb327e53c7765e60261ef13d4ec45bb02d0db117082.exe
    "C:\Users\Admin\AppData\Local\Temp\216176b4ebbcf066ad142fb327e53c7765e60261ef13d4ec45bb02d0db117082.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2652-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2652-1-0x0000000000D30000-0x0000000000E12000-memory.dmp
    Filesize

    904KB

    Download
  • memory/2652-2-0x0000000005E80000-0x0000000006424000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/2652-3-0x00000000058D0000-0x0000000005962000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2652-4-0x00000000059B0000-0x00000000059BA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2652-5-0x0000000005AB0000-0x0000000005B4C000-memory.dmp
    Filesize

    624KB

    Download
  • memory/2652-6-0x0000000074A20000-0x00000000751D0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/2652-7-0x0000000006B80000-0x0000000006B9A000-memory.dmp
    Filesize

    104KB

    Download
  • memory/2652-8-0x0000000005E70000-0x0000000005E80000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2652-9-0x0000000007020000-0x00000000070D8000-memory.dmp
    Filesize

    736KB

    Download
  • memory/2652-10-0x0000000074A2E000-0x0000000074A2F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2652-11-0x0000000074A20000-0x00000000751D0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/2652-12-0x0000000009860000-0x00000000098D6000-memory.dmp
    Filesize

    472KB

    Download
  • memory/2652-13-0x00000000099F0000-0x0000000009A56000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2652-14-0x0000000007270000-0x00000000072C0000-memory.dmp
    Filesize

    320KB

    Download