Analysis
-
max time kernel
145s -
max time network
15s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 07:03
General
-
Target
PO AA21C04U3101-MTXGA6_PDF.exe
-
Size
611KB
-
MD5
591c96d331d55c84ccb817c8957b63dd
-
SHA1
cf75bba79c7f3290936e2d00f86f4efd4aca7deb
-
SHA256
600715af104a41db6d18d62a5980b87423f009eac1b1b96330e06e3cb3314637
-
SHA512
05180607fe0450fbf81e1f67b7ff8b8cf88f0a6541a3df015c466de4c8e516c51b4ccc446634e1ab60aeee099d32375316a0d7e9f69be773caae676a85e4426b
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.nke.com.my - Port:
587 - Username:
godfrey@nke.com.my - Password:
Godfrey@2021
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO AA21C04U3101-MTXGA6_PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO AA21C04U3101-MTXGA6_PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-2-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/544-3-0x00000000013A0000-0x00000000013A1000-memory.dmpFilesize
4KB
-
memory/544-5-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/544-6-0x0000000000B40000-0x0000000000B44000-memory.dmpFilesize
16KB
-
memory/544-7-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/544-8-0x0000000001330000-0x000000000139D000-memory.dmpFilesize
436KB
-
memory/544-9-0x00000000011F0000-0x000000000122B000-memory.dmpFilesize
236KB
-
memory/544-10-0x0000000000340000-0x0000000000376000-memory.dmpFilesize
216KB