Analysis
- max time kernel
121s - max time network
165s - platform
windows7_x64 - resource
win7v20210408 - submitted
09/09/2021, 13:03
General
- Target Payment Advice 09092021 HSBC customer information.exe
- Size 720KB
- Sample210909-qaccmsgbg6
- SHA256 7010a3eb3e0b8019f4e9dbdcf0e83197c8a898a56c274bfe939002095310e9d1
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.pnmetal.com
-
Port
587
-
Username
-
Password
ihouOgf9
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice 09092021 HSBC customer information.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice 09092021 HSBC customer information.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice 09092021 HSBC customer information.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice 09092021 HSBC customer information.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/872-65-0x0000000000400000-0x000000000043C000-memory.dmp
memory/872-67-0x0000000000400000-0x000000000043C000-memory.dmp
memory/872-69-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
memory/1992-59-0x0000000001040000-0x0000000001041000-memory.dmp
memory/1992-61-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/1992-62-0x00000000003B0000-0x00000000003C6000-memory.dmp
memory/1992-63-0x0000000005210000-0x0000000005268000-memory.dmp
memory/1992-64-0x00000000005F0000-0x0000000000628000-memory.dmp