Analysis
-
max time kernel
80s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
04-12-2022 01:09
General
-
Target
Purchase Order16092020.exe
-
Size
687KB
-
MD5
25aa5c161b49e6cbfcc437c0cd8ca0cb
-
SHA1
bb53aba96b5626a8fe06901d1624e2f39988db6c
-
SHA256
3a8afa181b83a479c7c476791061dd4a7df56a59e21bcb72f0c8a32d76b66d5b
-
SHA512
db1645a233f765fe284642fb9315cf1a25d5a2fe878dd02fd18545df9ae9483b646042f74e27b6f66e6d5a02ddc5773a7b972df3ac31421b4f6f4b6b7b50f45d
-
SSDEEP
12288:W1oc0zzQX0rjJGVl747Rv55RxPiNC3C0Zm+YlgIipEO8v:2v0YX0rk87XbV/nm+YlgGZ
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
nc$jcXy8
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order16092020.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order16092020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order16092020.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order16092020.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
60KB