Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
21-11-2023 02:01
General
-
Target
231121-11-AgentTesla-fe5abc.exe
-
Size
1.3MB
-
MD5
233f382c6f7e034b6588fdd07dae612e
-
SHA1
fe5abc8495a6bd9643bdabd9463a6d1800fd9f39
-
SHA256
ed414c5cd76f7735a701b3c734bc8b7fc0d21e2143eae7925e57451d49b256ea
-
SHA512
c769410f24d1ca59e3342190ad0d6468f6b6f006892b42d633998674821910ad09e5161e0b466d0f201406ed19ceb84d1a1d57661c9a4796183146b3e0d6f231
-
SSDEEP
12288:+FJyQvvYEoIkcGUdLJWsYdt41FoMUcj/0jFSbvcv2Y2XxRkz9BhnVH:+FJyjEoI/GUFJKdt41hLBc2x2JBhn
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
gator3220.hostgator.com - Port:
587 - Username:
[email protected] - Password:
28#75@ts76&&p!!@@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\231121-11-AgentTesla-fe5abc.exe"C:\Users\Admin\AppData\Local\Temp\231121-11-AgentTesla-fe5abc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 13763⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5024 -ip 50241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
352KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
256KB
-
Filesize
1.3MB
-
Filesize
7.7MB
-
Filesize
256KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
7.7MB