Analysis
- max time kernel
151s - max time network
136s - platform
windows10_x64 - resource
win10-en - submitted
09/09/2021, 13:03
General
- Target Payment Advice 09092021 HSBC customer information.exe
- Size 720KB
- Sample210909-qaccmsgbg6
- SHA256 7010a3eb3e0b8019f4e9dbdcf0e83197c8a898a56c274bfe939002095310e9d1
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.pnmetal.com
-
Port
587
-
Username
-
Password
ihouOgf9
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice 09092021 HSBC customer information.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice 09092021 HSBC customer information.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice 09092021 HSBC customer information.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice 09092021 HSBC customer information.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2284-125-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2284-134-0x0000000006260000-0x0000000006261000-memory.dmp
memory/2284-133-0x0000000005670000-0x0000000005671000-memory.dmp
memory/2284-132-0x0000000005570000-0x0000000005A6E000-memory.dmp
memory/3264-119-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/3264-123-0x0000000008DA0000-0x0000000008DF8000-memory.dmp
memory/3264-124-0x000000000B710000-0x000000000B748000-memory.dmp
memory/3264-122-0x0000000008D80000-0x0000000008D96000-memory.dmp
memory/3264-121-0x0000000008E20000-0x0000000008E21000-memory.dmp
memory/3264-120-0x00000000057C0000-0x0000000005CBE000-memory.dmp
memory/3264-115-0x0000000000EC0000-0x0000000000EC1000-memory.dmp
memory/3264-118-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/3264-117-0x0000000005CC0000-0x0000000005CC1000-memory.dmp