Analysis
-
max time kernel
161s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
08-12-2022 19:43
General
-
Target
Shipping Docs PO12399/Shipping Docs PO12399.xlsx.exe
-
Size
440KB
-
MD5
a11bfa3fee20595f6562c0b2eb07fe83
-
SHA1
61dceafd6971eba650ebab7b8aa3f8ab42ade135
-
SHA256
6f3f44cde64cfb8b414ce1b26816a0e78bc14e90e2b5fee63991d9359122d481
-
SHA512
c69113d36c9c95f3550fd6ffade2df958aa332a910b827a559257ed7e6b52e62fa7852073c21108bda37cb7c063edae9debe4e9514394b7f6d8c7b7b5029ed6a
-
SSDEEP
12288:BXmWAakvgHhyXkv0xIYjbZcn4M79pkbzmKaukoki/:BXGYkUMx7VM4M79LiP/
Score
10/10
Malware Config
Extracted
Family
agenttesla
C2
https://api.telegram.org/bot5870878058:AAEtYpDY1LBnBQGwZvkWktoa3wzKq0kSk78/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Docs PO12399\Shipping Docs PO12399.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Docs PO12399\Shipping Docs PO12399.xlsx.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
192KB
-
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
408KB