Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
30-08-2023 14:17
General
-
Target
decode_2b7cf3a17e9659017e8aee42f4a9be35522b643b6ae4b5f7ed65a9d54422446e.exe
-
Size
237KB
-
MD5
fcd22f8d7de9651138f589cdfe8de3db
-
SHA1
adda0472966a2aceabab721e150990aaa2a2c938
-
SHA256
947656f82f97b060b6e7ea3fa904ab81632c5034ddad177fd024c29b2e222933
-
SHA512
270e1f55db497c862d7fb66e966c8c60acc3664fccb5098a0b8c055481871dd4dfd7ef06ae2759030d83beb1c0e50296c9957a5eb86137bb1ce823df1c0ab2c2
-
SSDEEP
3072:BQuqHDK5m2OqRWeboaVeg+x3dHbss5g/di:vsqRWebj+x3dHp5g
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.orkuntesisyonetim.com.tr - Port:
587 - Username:
[email protected] - Password:
Se-529.Gd - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\decode_2b7cf3a17e9659017e8aee42f4a9be35522b643b6ae4b5f7ed65a9d54422446e.exe"C:\Users\Admin\AppData\Local\Temp\decode_2b7cf3a17e9659017e8aee42f4a9be35522b643b6ae4b5f7ed65a9d54422446e.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
264KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB