PO AA21C04U3101-MTXGA6_PDF.exe

General
Target

PO AA21C04U3101-MTXGA6_PDF.exe

Filesize

611KB

Completed

08-04-2021 07:05

Score
10 /10
MD5

591c96d331d55c84ccb817c8957b63dd

SHA1

cf75bba79c7f3290936e2d00f86f4efd4aca7deb

SHA256

600715af104a41db6d18d62a5980b87423f009eac1b1b96330e06e3cb3314637

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.nke.com.my

Port: 587

Username: godfrey@nke.com.my

Password: Godfrey@2021

Signatures 4

Filter: none

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/4692-15-0x0000000007470000-0x00000000074A6000-memory.dmpfamily_agenttesla
  • Suspicious behavior: EnumeratesProcesses
    PO AA21C04U3101-MTXGA6_PDF.exe

    Reported IOCs

    pidprocess
    4692PO AA21C04U3101-MTXGA6_PDF.exe
    4692PO AA21C04U3101-MTXGA6_PDF.exe
    4692PO AA21C04U3101-MTXGA6_PDF.exe
    4692PO AA21C04U3101-MTXGA6_PDF.exe
    4692PO AA21C04U3101-MTXGA6_PDF.exe
  • Suspicious use of AdjustPrivilegeToken
    PO AA21C04U3101-MTXGA6_PDF.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege4692PO AA21C04U3101-MTXGA6_PDF.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\PO AA21C04U3101-MTXGA6_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\PO AA21C04U3101-MTXGA6_PDF.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:4692
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/4692-2-0x0000000073430000-0x0000000073B1E000-memory.dmp

                          • memory/4692-3-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                          • memory/4692-5-0x0000000005510000-0x0000000005511000-memory.dmp

                          • memory/4692-6-0x0000000005B30000-0x0000000005B31000-memory.dmp

                          • memory/4692-7-0x00000000056D0000-0x00000000056D1000-memory.dmp

                          • memory/4692-8-0x0000000005850000-0x0000000005851000-memory.dmp

                          • memory/4692-9-0x0000000005600000-0x0000000005601000-memory.dmp

                          • memory/4692-10-0x0000000005860000-0x0000000005861000-memory.dmp

                          • memory/4692-11-0x000000007F400000-0x000000007F401000-memory.dmp

                          • memory/4692-12-0x0000000008DB0000-0x0000000008DB4000-memory.dmp

                          • memory/4692-13-0x0000000001420000-0x000000000148D000-memory.dmp

                          • memory/4692-14-0x00000000014E0000-0x000000000151B000-memory.dmp

                          • memory/4692-15-0x0000000007470000-0x00000000074A6000-memory.dmp

                          • memory/4692-16-0x000000000EAE0000-0x000000000EAE1000-memory.dmp

                          • memory/4692-17-0x000000000EB80000-0x000000000EB81000-memory.dmp