Analysis
- max time kernel
116s - max time network
132s - platform
windows10_x64 - resource
win10v200722 - submitted
17/08/2020, 18:50
General
- Target DHL.PDF.bat.exe
- Size 92KB
- Sample200817-c3p5fl7ayx
- SHA256 53b08ccf3f21eb6c4c2556fd290210d57d8bcdfc92735573ee20839b81a2a98d
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL.PDF.bat.exe"C:\Users\Admin\AppData\Local\Temp\DHL.PDF.bat.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\DHL.PDF.bat.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/432-3-0x00000000720D0000-0x00000000727BE000-memory.dmp
memory/432-4-0x0000000000400000-0x0000000000401000-memory.dmp
memory/432-6-0x0000000020510000-0x0000000020511000-memory.dmp
memory/432-7-0x000000001FE30000-0x000000001FE31000-memory.dmp
memory/432-8-0x0000000000760000-0x0000000000761000-memory.dmp
memory/432-9-0x0000000020010000-0x0000000020011000-memory.dmp
memory/432-10-0x00000000203A0000-0x00000000203A1000-memory.dmp
memory/432-11-0x000000001D5B0000-0x000000001D5B1000-memory.dmp