Analysis
-
max time kernel
145s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-04-2021 10:43
General
-
Target
PO NO 16670,16671,16672.exe
-
Size
876KB
-
MD5
4b2da32775bb69ef313a77ed01c63ca5
-
SHA1
0f50b7d0721304ccf5c02a23da6a640980b2a24f
-
SHA256
e2ea537c8c7c8b76704a156bbf478fedb4464a9bc4dbd1468938c29c8e8b4ea9
-
SHA512
c1259c26ce296e18acfece290b771fcdf01dc47ee2074fd129da0a684f65ba2fb7b250e1a2685e50600faedbf7dd2ca6905e00aefcc82b37ac5bafc7421a2f2a
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.tph-buasysteme.com - Port:
587 - Username:
d.furchtmann@tph-buasysteme.com - Password:
kApkjKY8
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO NO 16670,16671,16672.exe"C:\Users\Admin\AppData\Local\Temp\PO NO 16670,16671,16672.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-60-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/1200-62-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB
-
memory/1200-63-0x00000000004C0000-0x00000000004C9000-memory.dmpFilesize
36KB
-
memory/1200-64-0x0000000005770000-0x00000000057EE000-memory.dmpFilesize
504KB
-
memory/1200-65-0x0000000000C00000-0x0000000000C42000-memory.dmpFilesize
264KB
-
memory/1200-66-0x0000000000290000-0x00000000002C7000-memory.dmpFilesize
220KB