Analysis
-
max time kernel
75s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
01-10-2022 09:07
General
-
Target
IMG-20220926-WA0000000008....exe
-
Size
882KB
-
MD5
a5e9194aebaee807a27b58dcc1a9b000
-
SHA1
94932b210e64a2349f6e824631dcc8298e719e09
-
SHA256
c7e5612eca504249bfde7ecc7bcdb3bb2220e9f0599aa675b6acd939d29e47bb
-
SHA512
a9df6bf6dc98d11d89b31d353a7dda6db76906940b2b181961a42fa5f57b1d560e297f4d737bb80f18b43e5d41e8017379ed9acfda4835a5fd80af9e0e945d2c
-
SSDEEP
12288:V7C+LVFcxr4tlKD9xK4oIl5j0Ne6Oz2NUMfyTiADqjJ5nu9H:BCWVF77WvXoIfoU6KMf7jrk
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.toala.com.mx - Port:
587 - Username:
[email protected] - Password:
oceano2012 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 6 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG-20220926-WA0000000008....exe"C:\Users\Admin\AppData\Local\Temp\IMG-20220926-WA0000000008....exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG-20220926-WA0000000008....exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
904KB
-
Filesize
240KB
-
Filesize
536KB
-
Filesize
68KB
-
Filesize
128KB
-
Filesize
68KB