Analysis
-
max time kernel
130s -
max time network
134s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-11-2020 06:48
General
-
Target
Ödeme Onayı Makbuzu.bat.exe
-
Size
495KB
-
MD5
f1403beee77693e48a78a543704705d7
-
SHA1
17b00ab88afdbc06e49dec700483573646821bb7
-
SHA256
bacbd1e1b139791f7ca8eeba6a14cf7b34c9c010aca5ce7eb527aea212448868
-
SHA512
03efef4ef7304742de3b3896e64c67c7d1a0cfca85a5828992e11c807ffcbe49d0e7ba668cbd90d24019bd5e26892a110ff4ac36aa0e3877485556eb377608ea
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.finalegitim.com.tr - Port:
587 - Username:
izmitortaokulu@finalegitim.com.tr - Password:
ek1234final
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ödeme Onayı Makbuzu.bat.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme Onayı Makbuzu.bat.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ödeme Onayı Makbuzu.bat.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5203⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1516-4-0x0000000000000000-mapping.dmp
-
memory/1516-5-0x0000000001E90000-0x0000000001EA1000-memory.dmpFilesize
68KB
-
memory/1780-0-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1780-1-0x00000000004374EE-mapping.dmp
-
memory/1780-2-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1780-3-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB