Analysis
- max time kernel
111s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
10/08/2021, 10:03
General
- Target VIETNAMESE HCU23123.exe
- Size 1.2MB
- Sample210810-rdm34c87cx
- SHA256 7d65371ce1f6ca3aae8d83206cc3484b54722f3993e94a2339482a02b3d94be7
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.scriptcopy.org
-
Port
587
-
Username
-
Password
t%K@flX5~T45
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VIETNAMESE HCU23123.exe"C:\Users\Admin\AppData\Local\Temp\VIETNAMESE HCU23123.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VIETNAMESE HCU23123.exe"C:\Users\Admin\AppData\Local\Temp\VIETNAMESE HCU23123.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1376-125-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1376-134-0x0000000005D60000-0x0000000005D61000-memory.dmp
memory/1376-133-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/1376-132-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/3128-119-0x0000000004B10000-0x0000000004B11000-memory.dmp
memory/3128-122-0x0000000002520000-0x000000000252B000-memory.dmp
memory/3128-123-0x0000000006220000-0x000000000629C000-memory.dmp
memory/3128-124-0x00000000062A0000-0x00000000062DD000-memory.dmp
memory/3128-121-0x0000000004B10000-0x000000000500E000-memory.dmp
memory/3128-120-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/3128-114-0x0000000000120000-0x0000000000121000-memory.dmp
memory/3128-118-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/3128-117-0x0000000005010000-0x0000000005011000-memory.dmp
memory/3128-116-0x0000000004A70000-0x0000000004A71000-memory.dmp