Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 07:03
General
-
Target
PO AA21C04U3101-MTXGA6_PDF.exe
-
Size
611KB
-
MD5
591c96d331d55c84ccb817c8957b63dd
-
SHA1
cf75bba79c7f3290936e2d00f86f4efd4aca7deb
-
SHA256
600715af104a41db6d18d62a5980b87423f009eac1b1b96330e06e3cb3314637
-
SHA512
05180607fe0450fbf81e1f67b7ff8b8cf88f0a6541a3df015c466de4c8e516c51b4ccc446634e1ab60aeee099d32375316a0d7e9f69be773caae676a85e4426b
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.nke.com.my - Port:
587 - Username:
godfrey@nke.com.my - Password:
Godfrey@2021
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO AA21C04U3101-MTXGA6_PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO AA21C04U3101-MTXGA6_PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4692-2-0x0000000073430000-0x0000000073B1E000-memory.dmpFilesize
6.9MB
-
memory/4692-3-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/4692-5-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/4692-6-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/4692-7-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/4692-8-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/4692-9-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/4692-10-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/4692-11-0x000000007F400000-0x000000007F401000-memory.dmpFilesize
4KB
-
memory/4692-12-0x0000000008DB0000-0x0000000008DB4000-memory.dmpFilesize
16KB
-
memory/4692-13-0x0000000001420000-0x000000000148D000-memory.dmpFilesize
436KB
-
memory/4692-14-0x00000000014E0000-0x000000000151B000-memory.dmpFilesize
236KB
-
memory/4692-15-0x0000000007470000-0x00000000074A6000-memory.dmpFilesize
216KB
-
memory/4692-16-0x000000000EAE0000-0x000000000EAE1000-memory.dmpFilesize
4KB
-
memory/4692-17-0x000000000EB80000-0x000000000EB81000-memory.dmpFilesize
4KB