Analysis
- max time kernel
121s - max time network
122s - platform
windows10_x64 - resource
win10 - submitted
17/08/2020, 13:45
General
- Target Quotation for Diepsloot Repairs Project.exe
- Size 649KB
- Sample200817-nzdthyhsrj
- SHA256 2b1b0832a94d3e2a53b597aab9a04130dfaca6dfcbb7dd43f2a6aff5a836ba98
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.thevirabali.com
-
Port
587
-
Username
-
Password
vira123
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"C:\Users\Admin\AppData\Local\Temp\Quotation for Diepsloot Repairs Project.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3024-5-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/3024-9-0x0000000006460000-0x00000000064EA000-memory.dmp
memory/3024-4-0x0000000005CC0000-0x0000000005CC1000-memory.dmp
memory/3024-0-0x0000000073B70000-0x000000007425E000-memory.dmp
memory/3024-6-0x0000000001890000-0x0000000001891000-memory.dmp
memory/3024-7-0x0000000005960000-0x0000000005961000-memory.dmp
memory/3024-3-0x0000000005720000-0x0000000005721000-memory.dmp
memory/3024-1-0x0000000000D70000-0x0000000000D71000-memory.dmp
memory/3024-8-0x00000000056F0000-0x00000000056F3000-memory.dmp
memory/3024-10-0x00000000064F0000-0x0000000006553000-memory.dmp
memory/3916-11-0x0000000000400000-0x0000000000458000-memory.dmp
memory/3916-14-0x0000000073B70000-0x000000007425E000-memory.dmp
memory/3916-19-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/3916-20-0x0000000005DC0000-0x0000000005DC1000-memory.dmp