Analysis
- max time kernel
142s - max time network
132s - platform
windows10_x64 - resource
win10v20210410 - submitted
13/05/2021, 14:08
General
- Target New Order PO#109355______pdf_________.exe
- Size 1.7MB
- Sample210513-xea98tfhfa
- SHA256 7bcd067c0a67a7a6e2c3f3079b626afb4f9ab1b8643b50dce1a69cd94fdab4ee
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.lokalboyz.com
-
Port
587
-
Username
-
Password
lkEb6ovn
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe"C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe"C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe"C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1644-125-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1644-134-0x00000000065F0000-0x00000000065F1000-memory.dmp
memory/1644-133-0x0000000005D60000-0x0000000005D61000-memory.dmp
memory/1644-132-0x0000000005900000-0x0000000005DFE000-memory.dmp
memory/3876-119-0x0000000004F00000-0x00000000053FE000-memory.dmp
memory/3876-122-0x0000000005240000-0x0000000005244000-memory.dmp
memory/3876-123-0x0000000000E20000-0x0000000000E99000-memory.dmp
memory/3876-124-0x0000000008130000-0x000000000816E000-memory.dmp
memory/3876-121-0x0000000005070000-0x0000000005071000-memory.dmp
memory/3876-120-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/3876-114-0x0000000000390000-0x0000000000391000-memory.dmp
memory/3876-118-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/3876-117-0x0000000005400000-0x0000000005401000-memory.dmp
memory/3876-116-0x0000000004E60000-0x0000000004E61000-memory.dmp