Analysis
- max time kernel
116s - max time network
20s - platform
windows7_x64 - resource
win7v20210408 - submitted
12/07/2021, 11:01
General
- Target DHL Express Courier Pickup Confirmation CBJ210623122097.exe
- Size 848KB
- Sample210712-sqljr2bena
- SHA256 9cf2a057f02576f4223e7c2f8ef4c217944385df4cd3180029ff96b80122d752
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.dekjmo.com
-
Port
587
-
Username
-
Password
eidOTv$9
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Express Courier Pickup Confirmation CBJ210623122097.exe"C:\Users\Admin\AppData\Local\Temp\DHL Express Courier Pickup Confirmation CBJ210623122097.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Express Courier Pickup Confirmation CBJ210623122097.exe"C:\Users\Admin\AppData\Local\Temp\DHL Express Courier Pickup Confirmation CBJ210623122097.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DHL Express Courier Pickup Confirmation CBJ210623122097.exe"C:\Users\Admin\AppData\Local\Temp\DHL Express Courier Pickup Confirmation CBJ210623122097.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/868-66-0x0000000000400000-0x000000000043C000-memory.dmp
memory/868-68-0x0000000000400000-0x000000000043C000-memory.dmp
memory/868-70-0x0000000000460000-0x0000000000461000-memory.dmp
memory/1640-60-0x0000000000C50000-0x0000000000C51000-memory.dmp
memory/1640-62-0x0000000005000000-0x0000000005001000-memory.dmp
memory/1640-63-0x00000000003E0000-0x00000000003F0000-memory.dmp
memory/1640-64-0x0000000004F20000-0x0000000004FA2000-memory.dmp
memory/1640-65-0x0000000000AC0000-0x0000000000AFD000-memory.dmp