Analysis
- max time kernel
151s - max time network
6s - platform
windows7_x64 - resource
win7v200722 - submitted
17/08/2020, 13:45
General
- Target Quotation for Diepsloot Repairs Project.exe
- Size 649KB
- Sample200817-nzdthyhsrj
- SHA256 2b1b0832a94d3e2a53b597aab9a04130dfaca6dfcbb7dd43f2a6aff5a836ba98
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.thevirabali.com
-
Port
587
-
Username
-
Password
vira123
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1504-0-0x00000000743C0000-0x0000000074AAE000-memory.dmp
memory/1504-1-0x00000000012B0000-0x00000000012B1000-memory.dmp
memory/1504-3-0x0000000000270000-0x0000000000273000-memory.dmp
memory/1504-4-0x00000000054F0000-0x000000000557A000-memory.dmp
memory/1504-5-0x0000000004C20000-0x0000000004C83000-memory.dmp
memory/1772-6-0x0000000000400000-0x0000000000458000-memory.dmp
memory/1772-8-0x0000000000400000-0x0000000000458000-memory.dmp
memory/1772-9-0x0000000000400000-0x0000000000458000-memory.dmp
memory/1772-10-0x00000000743C0000-0x0000000074AAE000-memory.dmp