Analysis
- max time kernel
90s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
19/05/2022, 16:28
General
- Target Original Shipping Documents_______xlsx.exe
- Size 29KB
- Sample220519-tym1tscdek
- SHA256 ef56c1816b203c94de799dfbc607f74fc7ef4c172322b09c6f2f10abecc3905f
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.imaniflowers.co.ke
-
Port
587
-
Username
-
Password
Imani2022#
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.imaniflowers.co.ke
-
Port
587
-
Username
-
Password
Imani2022#
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original Shipping Documents_______xlsx.exe"C:\Users\Admin\AppData\Local\Temp\Original Shipping Documents_______xlsx.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1572-130-0x00000000000B0000-0x00000000000BC000-memory.dmp
memory/2800-132-0x0000000000400000-0x000000000043A000-memory.dmp
memory/2800-133-0x00000000059C0000-0x0000000005F64000-memory.dmp
memory/2800-134-0x0000000005340000-0x00000000053DC000-memory.dmp
memory/2800-135-0x0000000005920000-0x0000000005986000-memory.dmp
memory/2800-136-0x00000000066C0000-0x0000000006710000-memory.dmp
memory/2800-137-0x0000000006A20000-0x0000000006AB2000-memory.dmp
memory/2800-138-0x00000000069E0000-0x00000000069EA000-memory.dmp