Analysis
- max time kernel
115s - max time network
150s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/08/2021, 11:54
General
- Target INDIA MUMBAI BOOKING.exe
- Size 836KB
- Sample210809-5sbpqewwle
- SHA256 0ad710da3c3e74e8562e4c6cc8f2d6d8fc0da38abbde279c4fa46b1ca485d4d2
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.scriptcopy.org
-
Port
587
-
Username
-
Password
t%K@flX5~T45
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\INDIA MUMBAI BOOKING.exe"C:\Users\Admin\AppData\Local\Temp\INDIA MUMBAI BOOKING.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INDIA MUMBAI BOOKING.exe"C:\Users\Admin\AppData\Local\Temp\INDIA MUMBAI BOOKING.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\INDIA MUMBAI BOOKING.exe"C:\Users\Admin\AppData\Local\Temp\INDIA MUMBAI BOOKING.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4192-125-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4192-134-0x0000000005E90000-0x0000000005E91000-memory.dmp
memory/4192-133-0x00000000052B0000-0x00000000052B1000-memory.dmp
memory/4192-132-0x0000000005230000-0x000000000572E000-memory.dmp
memory/4648-119-0x0000000004D20000-0x000000000521E000-memory.dmp
memory/4648-122-0x00000000084C0000-0x00000000084D1000-memory.dmp
memory/4648-123-0x0000000008740000-0x00000000087DD000-memory.dmp
memory/4648-124-0x000000000AEE0000-0x000000000AF18000-memory.dmp
memory/4648-121-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/4648-120-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/4648-114-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/4648-118-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/4648-117-0x0000000005220000-0x0000000005221000-memory.dmp
memory/4648-116-0x0000000004C80000-0x0000000004C81000-memory.dmp