Analysis
- max time kernel
43s - max time network
46s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
13/12/2022, 17:07
General
- Target 4f3ba00c238e7b22f320130564fac081.exe
- Size 649KB
- Sample221213-vmze6afc29
- SHA256 137e9fccdb01a5fab34c848d9adcd8367eef3b5b3bc90f9da975194baff54023
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.valvulasthermovalve.cl/
-
Port
21
-
Username
-
Password
LILKOOLL14!!
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f3ba00c238e7b22f320130564fac081.exe"C:\Users\Admin\AppData\Local\Temp\4f3ba00c238e7b22f320130564fac081.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f3ba00c238e7b22f320130564fac081.exe"C:\Users\Admin\AppData\Local\Temp\4f3ba00c238e7b22f320130564fac081.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1652-62-0x0000000005690000-0x0000000005706000-memory.dmp
memory/1652-74-0x00000000002F0000-0x00000000002FA000-memory.dmp
memory/1652-56-0x00000000002F0000-0x00000000002FA000-memory.dmp
memory/1652-63-0x00000000006E0000-0x000000000071A000-memory.dmp
memory/1652-57-0x00000000002F0000-0x00000000002FA000-memory.dmp
memory/1652-59-0x0000000000300000-0x0000000000312000-memory.dmp
memory/1652-60-0x0000000000B05000-0x0000000000B16000-memory.dmp
memory/1652-61-0x0000000000310000-0x000000000031E000-memory.dmp
memory/1652-55-0x00000000758C1000-0x00000000758C3000-memory.dmp
memory/1652-54-0x0000000000C00000-0x0000000000CA6000-memory.dmp
memory/1652-58-0x0000000000B05000-0x0000000000B16000-memory.dmp
memory/1652-75-0x0000000000B05000-0x0000000000B16000-memory.dmp
memory/1704-64-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1704-68-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1704-69-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1704-72-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1704-67-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1704-65-0x0000000000400000-0x000000000043A000-memory.dmp