Analysis
-
max time kernel
123s -
max time network
19s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-02-2021 12:53
General
-
Target
PO Contract -SCPL0882021 & sales contract ZD.1.19022021_PDF.exe
-
Size
532KB
-
MD5
1aee76519a71de3f3f4e7485c2fcc9cb
-
SHA1
7a0138e465d7dd20a726f3ccebf811b059355dd4
-
SHA256
95d7e599e9a76497dd73084440554dfcf4a94974d49e88c43f23611d4bce5d12
-
SHA512
8f039b136c2c49adee9aaf92b881702a81dfba08a5ae47226d5b41c267fc475471b4d7ecf2b3c8ac06234f8a97c738ac026d2f298e275c1f759609b578a7a4b3
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
fikriye@turuncoglu.com - Password:
Fikriye1234
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO Contract -SCPL0882021 & sales contract ZD.1.19022021_PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO Contract -SCPL0882021 & sales contract ZD.1.19022021_PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-2-0x0000000074660000-0x0000000074D4E000-memory.dmpFilesize
6.9MB
-
memory/1088-3-0x0000000001040000-0x0000000001041000-memory.dmpFilesize
4KB
-
memory/1088-5-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1088-6-0x00000000003D0000-0x00000000003D3000-memory.dmpFilesize
12KB
-
memory/1088-7-0x0000000000D60000-0x0000000000DBE000-memory.dmpFilesize
376KB
-
memory/1088-8-0x0000000000560000-0x0000000000596000-memory.dmpFilesize
216KB