Analysis
- max time kernel
131s - max time network
115s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/03/2021, 10:50
General
- Target SecuriteInfo.com.Trojan.GenericKDZ.73304.187.10433.exe
- Size 1.2MB
- Sample210309-eyf8v1d7e2
- SHA256 18624cae215e58079e8a9b236056a3a98efebf35ce799cb84cbaaf67b0972e0d
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.energstylgroup.com
-
Port
587
-
Username
-
Password
Urchman231
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73304.187.10433.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73304.187.10433.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73304.187.10433.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73304.187.10433.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/732-11-0x0000000005380000-0x0000000005381000-memory.dmp
memory/732-13-0x0000000006040000-0x000000000609D000-memory.dmp
memory/732-6-0x0000000005760000-0x0000000005761000-memory.dmp
memory/732-7-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/732-8-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/732-9-0x0000000005070000-0x0000000005071000-memory.dmp
memory/732-10-0x0000000005320000-0x0000000005321000-memory.dmp
memory/732-2-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/732-5-0x0000000005110000-0x0000000005111000-memory.dmp
memory/732-3-0x0000000000700000-0x0000000000701000-memory.dmp
memory/732-12-0x00000000050F0000-0x00000000050F7000-memory.dmp
memory/1324-14-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1324-17-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/1324-22-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/1324-23-0x0000000006460000-0x0000000006461000-memory.dmp
memory/1324-24-0x0000000006500000-0x0000000006501000-memory.dmp