Analysis
- max time kernel
203s - max time network
203s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
01/12/2022, 04:28
General
- Target SecuriteInfo.com.Win32.PWSX-gen.5830.11178.exe
- Size 576KB
- Sample221201-e3pmwshd4v
- SHA256 48c43477ab6fb8f02226023692730095547d1eeaee8916dd0f0a4de7f13319f6
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
Logistics@1234
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5830.11178.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5830.11178.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5830.11178.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5830.11178.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SecuriteInfo.com.Win32.PWSX-gen.5830.11178.exe.log
memory/1420-132-0x0000000000A20000-0x0000000000AB0000-memory.dmp
memory/1420-133-0x0000000005990000-0x0000000005F34000-memory.dmp
memory/1420-134-0x0000000005480000-0x0000000005512000-memory.dmp
memory/1420-135-0x00000000057D0000-0x0000000005976000-memory.dmp
memory/1420-136-0x0000000005580000-0x000000000558A000-memory.dmp
memory/1420-137-0x0000000007960000-0x00000000079FC000-memory.dmp
memory/1640-139-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1640-141-0x0000000006240000-0x00000000062A6000-memory.dmp