Analysis
- max time kernel
79s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/05/2022, 10:52
General
- Target PO.exe
- Size 729KB
- Sample220516-mydc3abchl
- SHA256 dba8ec09d04729a3bae55fc6d962fc7f03add01bc96b750f1f7889cbdba04fd5
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.petrogroup.co
-
Port
587
-
Username
-
Password
Petro@123
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.petrogroup.co
-
Port
587
-
Username
-
Password
Petro@123
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3068-136-0x0000000000400000-0x000000000043A000-memory.dmp
memory/3068-137-0x0000000006410000-0x0000000006476000-memory.dmp
memory/3068-138-0x0000000006980000-0x00000000069D0000-memory.dmp
memory/4656-130-0x0000000000060000-0x000000000011C000-memory.dmp
memory/4656-131-0x00000000050F0000-0x0000000005694000-memory.dmp
memory/4656-132-0x0000000004B40000-0x0000000004BD2000-memory.dmp
memory/4656-133-0x0000000004BE0000-0x0000000004C7C000-memory.dmp
memory/4656-134-0x0000000004AB0000-0x0000000004ABA000-memory.dmp