Analysis
- max time kernel
145s - max time network
148s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
30/09/2021, 08:50
General
- Target New Order 290921 MISC Equipment.exe
- Size 736KB
- Sample210930-krml2shbcm
- SHA256 a8e152a1b5793eb4ca893a1f011ec3e2ca4c15456e174eef8cfe1849cdcc8b4b
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.ministryofcustomsandtrade.org
-
Port
587
-
Username
-
Password
Fx*dVbu4
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order 290921 MISC Equipment.exe"C:\Users\Admin\AppData\Local\Temp\New Order 290921 MISC Equipment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order 290921 MISC Equipment.exe"C:\Users\Admin\AppData\Local\Temp\New Order 290921 MISC Equipment.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5203⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1216-53-0x0000000075B11000-0x0000000075B13000-memory.dmp
memory/1216-54-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/1216-55-0x00000000023C1000-0x00000000023C2000-memory.dmp
memory/1520-62-0x0000000000470000-0x0000000000471000-memory.dmp
memory/1572-56-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1572-59-0x00000000009A0000-0x00000000009A1000-memory.dmp