Overview

overview

10

Static

static

1

581ebd7150...42.exe

windows7-x64

10

581ebd7150...42.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 01:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    581ebd71502e26428ff03f5d743fbea09b17d22779e739c41022ac41cfac0242.exe

  • Size

    902KB

  • MD5

    23626a822afb45c288acf9fabbef5ad1

  • SHA1

    4e0db9f021191084331d9ed7164f066fe1003f06

  • SHA256

    581ebd71502e26428ff03f5d743fbea09b17d22779e739c41022ac41cfac0242

  • SHA512

    6d098502008b94d46abd74bbc5a9c53f7101da6538f44e634fb2556e970950474193c43de03dd37f56442fb4a5e47a6449f462e3a598a10602f20851f178b2b6

  • SSDEEP

    12288:C8zWaRWoy6JBmtWTDNO9UEJEgR4ADxRuAoZzqCqw+FWzu7rxK4qLEDkR:C8zWMMcBXTPg7CqwQrFo1

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 5 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\581ebd71502e26428ff03f5d743fbea09b17d22779e739c41022ac41cfac0242.exe
    "C:\Users\Admin\AppData\Local\Temp\581ebd71502e26428ff03f5d743fbea09b17d22779e739c41022ac41cfac0242.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Users\Admin\AppData\Local\Temp\581ebd71502e26428ff03f5d743fbea09b17d22779e739c41022ac41cfac0242.exe
      "C:\Users\Admin\AppData\Local\Temp\581ebd71502e26428ff03f5d743fbea09b17d22779e739c41022ac41cfac0242.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2280-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2280-1-0x0000000001180000-0x0000000001264000-memory.dmp
    Filesize

    912KB

    Download
  • memory/2280-2-0x0000000000430000-0x000000000044A000-memory.dmp
    Filesize

    104KB

    Download
  • memory/2280-3-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2280-4-0x0000000000390000-0x00000000003A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2280-5-0x00000000050F0000-0x0000000005174000-memory.dmp
    Filesize

    528KB

    Download
  • memory/2280-21-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2600-14-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2600-7-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2600-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2600-19-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2600-10-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2600-8-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2600-16-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2600-20-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2600-22-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2600-6-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2600-23-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download