Analysis
-
max time kernel
5s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
01/11/2023, 13:02
General
-
Target
c10ce97e6544cd7e04b4aa1a9c4df1eb.exe
-
Size
326KB
-
MD5
c10ce97e6544cd7e04b4aa1a9c4df1eb
-
SHA1
8549cd3ebaa0cbeed269cac3da0b41a43341951f
-
SHA256
4a274f08e6f2d51a2c34b022c9eb66bb8de77fa9fe05d2aef25e9c0dec6d6c01
-
SHA512
b0102e230b5d1ea1ff2f473ebd357779cdbf6b9d8fbc02289524b4ce7962842fd62ab53a881d2d948feb68d488136bdc38ed67f7ba7ccea06ed6b47c115370dc
-
SSDEEP
6144:fQ606x5wOyFNKvLOsI5H8Tx836e1NputSMFNZc9t6nzNH45X:/wDSvysI58x83R1NpsVFfZn945X
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.coolinic.com.my - Port:
587 - Username:
[email protected] - Password:
Nadiya1611 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\c10ce97e6544cd7e04b4aa1a9c4df1eb.exe"C:\Users\Admin\AppData\Local\Temp\c10ce97e6544cd7e04b4aa1a9c4df1eb.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Users\Admin\AppData\Local\Temp\c10ce97e6544cd7e04b4aa1a9c4df1eb.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD59625d5b1754bc4ff29281d415d27a0fd
SHA180e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA256c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
SHA512dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
-
Filesize
1.7MB
-
Filesize
856KB
-
Filesize
24KB
-
Filesize
1.7MB
-
Filesize
2.1MB
-
Filesize
85.8MB
-
Filesize
192KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB