Analysis

  • max time kernel
    123s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-07-2021 17:33

General

  • Target

    PO#55442676.exe

  • Size

    860KB

  • MD5

    12461631c81fa8e11f62afdad7d24be8

  • SHA1

    d8b6b589cc02a865af24f4ae87a2d4ea6b4ae4f6

  • SHA256

    77d4db3d0d8be6fee0817f5d835f0c904649d78078e6c78b2d7c224026fed3b3

  • SHA512

    86be5061fc9d8bb750d5026932866380a08994946ddad29cd30ef784be284a68ed4c0bdf600356841d88d0ce01576640b3fd62df3fc401ccba67efb2deb16ce4

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.vivaldi.net
  • Port:
    587
  • Username:
    chinalee@vivaldi.net
  • Password:
    chinalee2020

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO#55442676.exe
    "C:\Users\Admin\AppData\Local\Temp\PO#55442676.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4036

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4036-114-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
    Filesize

    4KB

  • memory/4036-116-0x0000000005880000-0x00000000058D1000-memory.dmp
    Filesize

    324KB

  • memory/4036-117-0x000000000A230000-0x000000000A231000-memory.dmp
    Filesize

    4KB

  • memory/4036-118-0x00000000058E0000-0x00000000058E1000-memory.dmp
    Filesize

    4KB

  • memory/4036-119-0x00000000059A0000-0x00000000059A1000-memory.dmp
    Filesize

    4KB

  • memory/4036-120-0x0000000003200000-0x0000000003201000-memory.dmp
    Filesize

    4KB

  • memory/4036-121-0x0000000006800000-0x0000000006802000-memory.dmp
    Filesize

    8KB

  • memory/4036-122-0x00000000068B0000-0x00000000068B1000-memory.dmp
    Filesize

    4KB

  • memory/4036-123-0x0000000005F70000-0x0000000005FE2000-memory.dmp
    Filesize

    456KB

  • memory/4036-124-0x0000000005EE0000-0x0000000005F18000-memory.dmp
    Filesize

    224KB

  • memory/4036-125-0x0000000006130000-0x0000000006166000-memory.dmp
    Filesize

    216KB

  • memory/4036-126-0x0000000006A90000-0x0000000006A91000-memory.dmp
    Filesize

    4KB

  • memory/4036-127-0x0000000007C40000-0x0000000007C41000-memory.dmp
    Filesize

    4KB