Analysis
- max time kernel
93s - max time network
46s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
30/11/2022, 12:42
General
- Target SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe
- Size 603KB
- Sample221130-pxbtysbc49
- SHA256 32e235425a71459bee33dffde1c4cb63c4ba379802d618c97f950e94ec2231c0
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocument
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 6 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/632-64-0x0000000000400000-0x000000000043C000-memory.dmp
memory/632-65-0x0000000000400000-0x000000000043C000-memory.dmp
memory/632-70-0x0000000000400000-0x000000000043C000-memory.dmp
memory/632-61-0x0000000000400000-0x000000000043C000-memory.dmp
memory/632-60-0x0000000000400000-0x000000000043C000-memory.dmp
memory/632-63-0x0000000000400000-0x000000000043C000-memory.dmp
memory/632-68-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1448-55-0x00000000764D1000-0x00000000764D3000-memory.dmp
memory/1448-54-0x0000000001090000-0x000000000112E000-memory.dmp
memory/1448-59-0x0000000000850000-0x000000000088C000-memory.dmp
memory/1448-58-0x0000000005A10000-0x0000000005A86000-memory.dmp
memory/1448-57-0x00000000004E0000-0x00000000004EE000-memory.dmp
memory/1448-56-0x00000000004C0000-0x00000000004D6000-memory.dmp