Analysis
-
max time kernel
121s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 12:47
General
-
Target
invoice and packing list.pdf.exe
-
Size
905KB
-
MD5
5fe3af8698d46cb668b36cda32381df9
-
SHA1
08f42bff933e193f76119e59e8c8d7df52271332
-
SHA256
33a72fddfb31f23f71b11ac223b87c62e1dcc371c6f238804220e0d969f09504
-
SHA512
4c488b7f4fce8046f0c60e26b96a6c57cd1f29d38b8a8911343fc9c28bbf30f55790623b78862ba6a31fbde9c78d16ea79de6434c6ce31c2b464fb1eba0b8855
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.targethyd.com - Port:
587 - Username:
invoice@targethyd.com - Password:
marketing369456
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice and packing list.pdf.exe"C:\Users\Admin\AppData\Local\Temp\invoice and packing list.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice and packing list.pdf.exe"C:\Users\Admin\AppData\Local\Temp\invoice and packing list.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1144-126-0x000000000043764E-mapping.dmp
-
memory/1144-133-0x0000000006330000-0x0000000006331000-memory.dmpFilesize
4KB
-
memory/1144-132-0x0000000005BA0000-0x0000000005BA1000-memory.dmpFilesize
4KB
-
memory/1144-131-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/1144-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4008-121-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/4008-114-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/4008-122-0x00000000050C0000-0x00000000050C4000-memory.dmpFilesize
16KB
-
memory/4008-123-0x0000000005D20000-0x0000000005DEB000-memory.dmpFilesize
812KB
-
memory/4008-124-0x00000000082B0000-0x0000000008346000-memory.dmpFilesize
600KB
-
memory/4008-120-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/4008-119-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/4008-118-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/4008-117-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/4008-116-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB