Overview

overview

10

Static

static

3

QDecrypt.exe

windows7-x64

10

QDecrypt.exe

windows10-2004-x64

3

QDecrypt.exe

windows7-x64

3

QDecrypt.exe

windows10-2004-x64

3

QF-mx1.kom...DD2.01

windows7-x64

3

QF-mx1.kom...DD2.01

windows10-2004-x64

3

vsapi32.dll

windows7-x64

3

vsapi32.dll

windows10-2004-x64

3

Resubmissions

13/12/2024, 02:03

241213-cgw4qsvme1 10

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/12/2024, 02:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    QDecrypt.exe

  • Size

    952KB

  • MD5

    be6086b33699a2c56233cd55c36ecfca

  • SHA1

    bc9ae30e3fc72d3a40c864095cbeb4c55b51ccdf

  • SHA256

    fec18f885bc9b84835873b54705efa4e92b47fe50e9c9a8b0ff935f1d173758d

  • SHA512

    f64d44dd3048d74a62b627e72a569d8d72a84a0696eb55d09d49d0d1fe77e68a59e44dcef3ce7b94f83043b0302b52d81c4489b81550d429d1ca58c595180562

  • SSDEEP

    24576:grGha+IYGXRz8vgobejS932cUSUsjs6666666l:KGEhX9obH932cUSUsjT

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • Executes dropped EXE 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QDecrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\QDecrypt.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2264
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2588
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    PID:2568
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2920
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x1f8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:756
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Videos\p003
      1⤵
        PID:1224
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Videos\" -an -ai#7zMap24130:64:7zEvent2876
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2220
      • C:\Users\Admin\Videos\06.exe
        "C:\Users\Admin\Videos\06.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\Videos\06.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2648

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Videos\06.exe
        Filesize

        1.0MB

        MD5

        edb4cbdc3e425a6230ed2313a77be7e4

        SHA1

        f308dee5d68796fb2f37f3170d1b3f7ed8294e6d

        SHA256

        39c15e35f0b21b2680c56f0f281feffba42f17e437e4234fb2f575678e3afbd9

        SHA512

        4d645fcbb4bbbca5981c32dfd4af79d2966e8c71198af9926a7b092d28692b7380a7aae3d0d7359a2909e39208c003f718231c2460385ffaf7d0f497d252db63

        Download Submit

      • C:\Users\Admin\Videos\p003.zip
        Filesize

        575KB

        MD5

        af2b08eb07660f845e6f45216f76814d

        SHA1

        eb784b59e6d8dbdf2a8aae9f8cf954e073b3bc49

        SHA256

        a8086d1b7e98bc52909f866b3d0087949862308bf9f5027a17be88a67265700c

        SHA512

        03dfe8a797b371c4bfdc61f0dc0bd05d3060a1a239ab1ab22e311ea0d2814caffb724738d475b492687acf09ba13c904aac84bc504d23285a98c54b952225b6f

        Download Submit

      • memory/2264-0-0x00000000063E0000-0x00000000063E2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2648-16-0x0000000000090000-0x00000000000D0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/2648-17-0x0000000000090000-0x00000000000D0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/2648-24-0x0000000000090000-0x00000000000D0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/2648-21-0x0000000000090000-0x00000000000D0000-memory.dmp

        Filesize

        256KB

        Download