Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 12:00
General
-
Target
SecuriteInfo.com.Artemis8D75B32933A7.14219.12415.exe
-
Size
597KB
-
MD5
8d75b32933a773d2a57edd0385b2adb1
-
SHA1
9515c6ba27814cc72fc11558a06546ac95c38beb
-
SHA256
99c4db677174d26eb39dfc095ed2a8ff7b3716f0e0e9ad7a6064e28367bd5a63
-
SHA512
00a30d6c62c12645f503f4b372a753929397958cb866c73020959dcb785deaa25fd7fa0719eb45d49b3fba0a911a6fe31c205463d2b543eb9ecfaafda6a189d1
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis8D75B32933A7.14219.12415.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis8D75B32933A7.14219.12415.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis8D75B32933A7.14219.12415.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis8D75B32933A7.14219.12415.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Artemis8D75B32933A7.14219.12415.exe.logMD5
c3cc52ccca9ff2b6fa8d267fc350ca6b
SHA1a68d4028333296d222e4afd75dea36fdc98d05f3
SHA2563125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e
SHA512b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7
-
memory/2220-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2220-134-0x0000000006270000-0x0000000006271000-memory.dmpFilesize
4KB
-
memory/2220-133-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/2220-132-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/2220-126-0x000000000043764E-mapping.dmp
-
memory/4660-119-0x0000000005910000-0x0000000005E0E000-memory.dmpFilesize
5.0MB
-
memory/4660-122-0x000000007E060000-0x000000007E061000-memory.dmpFilesize
4KB
-
memory/4660-123-0x0000000001860000-0x00000000018D4000-memory.dmpFilesize
464KB
-
memory/4660-124-0x0000000008B80000-0x0000000008BBC000-memory.dmpFilesize
240KB
-
memory/4660-121-0x0000000005D50000-0x0000000005D59000-memory.dmpFilesize
36KB
-
memory/4660-120-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/4660-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/4660-118-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/4660-117-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/4660-116-0x0000000005E10000-0x0000000005E11000-memory.dmpFilesize
4KB