PO AA21C04U3101-MTXGA6_PDF.exe

General
Target

PO AA21C04U3101-MTXGA6_PDF.exe

Filesize

611KB

Completed

08-04-2021 07:05

Score
10 /10
MD5

591c96d331d55c84ccb817c8957b63dd

SHA1

cf75bba79c7f3290936e2d00f86f4efd4aca7deb

SHA256

600715af104a41db6d18d62a5980b87423f009eac1b1b96330e06e3cb3314637

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.nke.com.my

Port: 587

Username: godfrey@nke.com.my

Password: Godfrey@2021

Signatures 4

Filter: none

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/544-10-0x0000000000340000-0x0000000000376000-memory.dmpfamily_agenttesla
  • Suspicious behavior: EnumeratesProcesses
    PO AA21C04U3101-MTXGA6_PDF.exe

    Reported IOCs

    pidprocess
    544PO AA21C04U3101-MTXGA6_PDF.exe
    544PO AA21C04U3101-MTXGA6_PDF.exe
    544PO AA21C04U3101-MTXGA6_PDF.exe
    544PO AA21C04U3101-MTXGA6_PDF.exe
  • Suspicious use of AdjustPrivilegeToken
    PO AA21C04U3101-MTXGA6_PDF.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege544PO AA21C04U3101-MTXGA6_PDF.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\PO AA21C04U3101-MTXGA6_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\PO AA21C04U3101-MTXGA6_PDF.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:544
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/544-2-0x00000000749D0000-0x00000000750BE000-memory.dmp

                          • memory/544-3-0x00000000013A0000-0x00000000013A1000-memory.dmp

                          • memory/544-5-0x0000000000E10000-0x0000000000E11000-memory.dmp

                          • memory/544-6-0x0000000000B40000-0x0000000000B44000-memory.dmp

                          • memory/544-7-0x000000007EF40000-0x000000007EF41000-memory.dmp

                          • memory/544-8-0x0000000001330000-0x000000000139D000-memory.dmp

                          • memory/544-9-0x00000000011F0000-0x000000000122B000-memory.dmp

                          • memory/544-10-0x0000000000340000-0x0000000000376000-memory.dmp