Analysis
-
max time kernel
135s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 14:40
General
-
Target
PROFORMA INVOICE-021&024.exe
-
Size
790KB
-
MD5
043a4e8ecc28687716d84bd0e91558b2
-
SHA1
4292192ed5bf6475de6ab5160f6b7a3e0ea6fe28
-
SHA256
b74d3621bbd10bcf7512d3a54a9625ee1ebd11d4351dd54fdd8dce4f36ca57b9
-
SHA512
d5e4b3ac6ccaa4ad36253aa1da31e67bd9d60d46faff3dc1968a1410970ccb2a59d83a4ad873fd568ea77ba3a55f7c43136b209f0ef43395e8dd571a1f26dbca
-
SSDEEP
12288:rxwDU1ezM/uL99H+lxVbQ5t7s9PWQQZNFFCV5i8Ehb:dmA699MxVbQDo9wZNFFCVU9h
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.obynnehhhan.com - Port:
587 - Username:
[email protected] - Password:
G$MUuYG3
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 6 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE-021&024.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE-021&024.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
816KB
-
Filesize
240KB
-
Filesize
472KB
-
Filesize
48KB
-
Filesize
96KB