Analysis
- max time kernel
84s - max time network
67s - platform
windows7_x64 - resource
win7 - submitted
25/06/2020, 07:09
General
- Target 23ab275366b16055b5e7eb150d65b0b8.exe
- Size 360KB
- Sample200625-7hhfpdtgrs
- SHA256 d749f756093b6a3ee4d5265ea6f9e82aa517c754487fcbebb7a748324cbcd10e
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ab275366b16055b5e7eb150d65b0b8.exe"C:\Users\Admin\AppData\Local\Temp\23ab275366b16055b5e7eb150d65b0b8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken