Analysis
-
max time kernel
151s -
max time network
31s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 12:44
General
-
Target
greattastesmb.ca_wp_content_plugins_duplicator_files_jiz.exe.malw.exe
-
Size
277KB
-
MD5
cacc88f2d5f39e672ea5a23a45afeb41
-
SHA1
e11de0b60ae05050994ca65df594bf0974add77c
-
SHA256
4c527bf526ae074003fa8688bb2bc55d0dfcf3712fc2e0bafefa1ca09b00e97f
-
SHA512
bceae89a3190453750067af54d24f6696715312112f4b72c51cbf189d52b2b6d9f02f645dbdc8a8e5458d09506f4569ada784f6e4e8cdb24ccaa01b0c67b1f53
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\greattastesmb.ca_wp_content_plugins_duplicator_files_jiz.exe.malw.exe"C:\Users\Admin\AppData\Local\Temp\greattastesmb.ca_wp_content_plugins_duplicator_files_jiz.exe.malw.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken