Overview

overview

10

Static

static

PO Contrac...DF.exe

windows7_x64

10

PO Contrac...DF.exe

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    23-02-2021 12:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO Contract -SCPL0882021 & sales contract ZD.1.19022021_PDF.exe

  • Size

    532KB

  • MD5

    1aee76519a71de3f3f4e7485c2fcc9cb

  • SHA1

    7a0138e465d7dd20a726f3ccebf811b059355dd4

  • SHA256

    95d7e599e9a76497dd73084440554dfcf4a94974d49e88c43f23611d4bce5d12

  • SHA512

    8f039b136c2c49adee9aaf92b881702a81dfba08a5ae47226d5b41c267fc475471b4d7ecf2b3c8ac06234f8a97c738ac026d2f298e275c1f759609b578a7a4b3

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    fikriye@turuncoglu.com
  • Password:
    Fikriye1234

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO Contract -SCPL0882021 & sales contract ZD.1.19022021_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\PO Contract -SCPL0882021 & sales contract ZD.1.19022021_PDF.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/636-2-0x0000000073190000-0x000000007387E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/636-3-0x00000000002B0000-0x00000000002B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/636-5-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/636-6-0x0000000005250000-0x0000000005251000-memory.dmp
    Filesize

    4KB

    Download
  • memory/636-7-0x0000000004C70000-0x0000000004C71000-memory.dmp
    Filesize

    4KB

    Download
  • memory/636-8-0x0000000002700000-0x0000000002701000-memory.dmp
    Filesize

    4KB

    Download
  • memory/636-9-0x0000000004E70000-0x0000000004E71000-memory.dmp
    Filesize

    4KB

    Download
  • memory/636-10-0x0000000000E00000-0x0000000000E01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/636-11-0x0000000004F10000-0x0000000004F13000-memory.dmp
    Filesize

    12KB

    Download
  • memory/636-12-0x0000000006950000-0x00000000069AE000-memory.dmp
    Filesize

    376KB

    Download
  • memory/636-13-0x00000000069B0000-0x00000000069E6000-memory.dmp
    Filesize

    216KB

    Download
  • memory/636-14-0x0000000006AB0000-0x0000000006AB1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/636-15-0x0000000008760000-0x0000000008761000-memory.dmp
    Filesize

    4KB

    Download