Overview

overview

10

Static

static

1

SecuriteIn...77.exe

windows7-x64

10

SecuriteIn...77.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 08:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.W32.MSIL_Kryptik.KZR.gen.Eldorado.14377.exe

  • Size

    930KB

  • MD5

    5a9fb46b5034fd8af30f74735eeef49c

  • SHA1

    8cf680dd42e9e4e1649698573e3f17ab9919df8e

  • SHA256

    fc1ef39decb8a6c7b9ba61c4a4be9048d9e7ac29619e6704d7549f1524a3b6a3

  • SHA512

    bb20326cea0985e0001d922c6392a2e1b42fb14fdcab7fa890e91e9236bc53db84b82f8cad3988aad01453f306fce0f46e44e6ddab8252bee45468bddcc250f0

  • SSDEEP

    12288:tuZsuRLyfDp2XqM6KTzDTtRXKVXx/uLxojvG8rMUxkR:gZsg+fDp2XxZTrWcG+hUs

Score
10/10
agentteslaexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.KZR.gen.Eldorado.14377.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.KZR.gen.Eldorado.14377.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.KZR.gen.Eldorado.14377.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2004
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WBiJAzSTzgbR.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WBiJAzSTzgbR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D55.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2656
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.KZR.gen.Eldorado.14377.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.KZR.gen.Eldorado.14377.exe"
      2⤵
        PID:564
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.KZR.gen.Eldorado.14377.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.KZR.gen.Eldorado.14377.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp4D55.tmp
      Filesize

      1KB

      MD5

      88892a8f9b0469e38b1ec66e88fe944c

      SHA1

      33b0d239adcc87af9663a1928eb46c7c391c6819

      SHA256

      89b6720f2388138422b35319542c5dc0e76aabcfbf8d9847836f5a0372ca7558

      SHA512

      46580f39f0620ce93ff76e9f17dea1520e4a7a79c1408f5b7c1cf958054e8fb9a69bc1cd20cc33069d1408d329d3d952341a3f748931e240ac4525b0ef74565e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      c0ac0cf2f028b2311c07b0b23a9c43b0

      SHA1

      a9214b47f0e77ca3fe6aa931b470ff43e52facc9

      SHA256

      05b78313f43ab113cbcb2933ccb7b990c75159cfe38be725a9b6c63da2a74c49

      SHA512

      80d65ca89c49fe44c4b769044ae8309eafa85503ce3d4bc41ad86aca52377214f413f2d48d1bb6c1c837738c93a13f18fb4c16629a489a1dc69125e2d7f43c48

      Download Submit

    • memory/2104-30-0x0000000074BA0000-0x000000007528E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2104-1-0x0000000000B80000-0x0000000000C6C000-memory.dmp

      Filesize

      944KB

      Download

    • memory/2104-2-0x0000000074BA0000-0x000000007528E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2104-3-0x0000000000380000-0x000000000039A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/2104-4-0x0000000000320000-0x0000000000330000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2104-5-0x0000000005340000-0x00000000053C2000-memory.dmp

      Filesize

      520KB

      Download

    • memory/2104-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2576-22-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2576-24-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2576-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2576-29-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2576-28-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2576-27-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2576-20-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2576-18-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

      Download