Analysis
-
max time kernel
63s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 22:02
General
-
Target
Ordine 400225.xlxs.exe
-
Size
565KB
-
MD5
39541aa8dbd218a6f461dd96c336a018
-
SHA1
0fe5d981ecd0282efadb0a68dbb83b5ab941e227
-
SHA256
ab6679b01e9981f3deb6bc1fb9bd165649c23ae2e3aca6c20293be08eec61fa4
-
SHA512
84078406c12e7bbd754defd1cb5b06321ff4fa312e48987655d4b15e1072931e8b5c5c35a3aaec05f6db87537f5e61a8ec54467e11e7006fc64993616322a4b1
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.abr.rs - Port:
587 - Username:
[email protected] - Password:
Royal-1111
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ordine 400225.xlxs.exe"C:\Users\Admin\AppData\Local\Temp\Ordine 400225.xlxs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ordine 400225.xlxs.exe"C:\Users\Admin\AppData\Local\Temp\Ordine 400225.xlxs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5203⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
4KB
-
Filesize
240KB
-
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB