Analysis
-
max time kernel
98s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
29-01-2021 07:38
Static task
static1
Behavioral task
behavioral1
Sample
DINTEC Order 28012021.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DINTEC Order 28012021.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
DINTEC Order 28012021.exe
-
Size
1.1MB
-
MD5
16a00e358736ae0bf135aec278aee516
-
SHA1
e23a6de31dcefda3d84fcd8b0122f33c1a726249
-
SHA256
bd89f6e2794f0c383ca15b99c53a28d6b527be58ec713efcafff4f0db21959f9
-
SHA512
62818848086b033eed1d1f43a133ae66e6da4d23b3d99b32ab5410d33f52f978c12ab84d231b461fd4249f086ce955c0a3d67d5eec325a9dd4c3ad7667f9a27a
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
[email protected] - Password:
Grace@331011Thinck
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1432-9-0x000000000043752E-mapping.dmp family_agenttesla behavioral1/memory/1432-8-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1432-11-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DINTEC Order 28012021.exedescription pid process target process PID 1812 set thread context of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
DINTEC Order 28012021.exeDINTEC Order 28012021.exepid process 1812 DINTEC Order 28012021.exe 1812 DINTEC Order 28012021.exe 1432 DINTEC Order 28012021.exe 1432 DINTEC Order 28012021.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DINTEC Order 28012021.exeDINTEC Order 28012021.exedescription pid process Token: SeDebugPrivilege 1812 DINTEC Order 28012021.exe Token: SeDebugPrivilege 1432 DINTEC Order 28012021.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
DINTEC Order 28012021.exedescription pid process target process PID 1812 wrote to memory of 1424 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1424 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1424 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1424 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe PID 1812 wrote to memory of 1432 1812 DINTEC Order 28012021.exe DINTEC Order 28012021.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DINTEC Order 28012021.exe"C:\Users\Admin\AppData\Local\Temp\DINTEC Order 28012021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DINTEC Order 28012021.exe"C:\Users\Admin\AppData\Local\Temp\DINTEC Order 28012021.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DINTEC Order 28012021.exe"C:\Users\Admin\AppData\Local\Temp\DINTEC Order 28012021.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1432-9-0x000000000043752E-mapping.dmp
-
memory/1432-8-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1432-10-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1432-11-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1432-13-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1812-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1812-3-0x0000000001370000-0x0000000001371000-memory.dmpFilesize
4KB
-
memory/1812-5-0x0000000000320000-0x0000000000323000-memory.dmpFilesize
12KB
-
memory/1812-6-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/1812-7-0x00000000056E0000-0x0000000005781000-memory.dmpFilesize
644KB