Overview

overview

10

Static

static

Quotation6...9..exe

windows7_x64

10

Quotation6...9..exe

windows10-2004_x64

10

Analysis

  • max time kernel
    165s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 00:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Quotation655511048786549..exe

  • Size

    422KB

  • MD5

    7fa97016462d711791fd3b3dd16f0205

  • SHA1

    1463aca8f64724d51b691a96d0f94a611ddd7d7c

  • SHA256

    c99d0b434418dcf5e39b3389aebabfd10bd9920e5ca670bdedc08dbd0832dee2

  • SHA512

    7b94a0df90caf98cd66485063cf93a7548997fc76ef8454462af3e7de00d4baab0b9e4e12b09cf758dbd8cd4259a8d4b8f62c9b69d5683e131d2dfa480f8a1d1

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mmm777

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quotation655511048786549..exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation655511048786549..exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\Temp\Quotation655511048786549..exe
      "{path}"
      2⤵
        PID:228
      • C:\Users\Admin\AppData\Local\Temp\Quotation655511048786549..exe
        "{path}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3468

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/228-131-0x0000000000000000-mapping.dmp
      Download
    • memory/2092-130-0x00000000746B0000-0x0000000074C61000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/3468-132-0x0000000000000000-mapping.dmp
      Download
    • memory/3468-133-0x0000000000400000-0x000000000044E000-memory.dmp
      Filesize

      312KB

      Download
    • memory/3468-134-0x00000000746B0000-0x0000000074C61000-memory.dmp
      Filesize

      5.7MB

      Download