Analysis
-
max time kernel
100s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
29-03-2023 09:40
General
-
Target
download.exe
-
Size
163KB
-
MD5
dc6e37fd36946a6681955aa9a462a009
-
SHA1
07aa2d9a8b8cbfad6f88289bf49e38d420354af0
-
SHA256
8c08ef05c00b42193b35610c68da0730d8f881fc1ec474bc5dfdcf5d4252e440
-
SHA512
a12708f69794153bf7c4d6e717537a65759dac7a2d0e98ad06c91bd5c2405753839b1524ce8998fcc9254ab167d3016d8ec546c9adadbd4880c9a1b35d7dee51
-
SSDEEP
3072:Zjl/jgj0yAbLety1u4NjmZ//lETO8tfiBSgKO4d9RrB3sAgJm/Ekd:zlyAbLGotNjmN/OTO8eS53RrFZaor
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: ftp- Host:
ftp://ftp.sisoempresarialsas.com - Port:
21 - Username:
[email protected] - Password:
.!LV?]FKWxUy
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
320KB
-
Filesize
64KB