Analysis
-
max time kernel
132s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 15:16
General
-
Target
DINTEC Order List 14012021.exe
-
Size
673KB
-
MD5
f49113b2bfcd362479248c011aedad15
-
SHA1
730d2f07cc7f0634b9aa24b0d64f75a57fe1b45e
-
SHA256
7e91bd9c26986e7437f8dc154a39978a042f8f1240067c907e8f49b791d3dc07
-
SHA512
daefa7258a37269d14a80493ceed25aeafb74a3fd03b5722dbfdc9ae22d09f691b8599d4d06bd53b0e50edb8ad55796b7640e7c1710297a3e70df62dac48685e
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
[email protected] - Password:
Grace@331011Thinck
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DINTEC Order List 14012021.exe"C:\Users\Admin\AppData\Local\Temp\DINTEC Order List 14012021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2496-11-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2496-19-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/2496-18-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/2496-13-0x0000000073BA0000-0x000000007428E000-memory.dmpFilesize
6.9MB
-
memory/2496-12-0x000000000043752E-mapping.dmp
-
memory/3940-6-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/3940-9-0x00000000076F0000-0x0000000007789000-memory.dmpFilesize
612KB
-
memory/3940-10-0x0000000007830000-0x0000000007831000-memory.dmpFilesize
4KB
-
memory/3940-8-0x0000000007580000-0x000000000758E000-memory.dmpFilesize
56KB
-
memory/3940-7-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/3940-2-0x0000000073BA0000-0x000000007428E000-memory.dmpFilesize
6.9MB
-
memory/3940-5-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/3940-3-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB