Analysis
-
max time kernel
58s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 00:08
General
-
Target
2120aedbd73a301f04c000936d7ffd6d.exe
-
Size
752KB
-
MD5
2120aedbd73a301f04c000936d7ffd6d
-
SHA1
a374f6f95986a9d83cd7c5941b0c0c66b2b33eb0
-
SHA256
09b7207f8b484865f95554a6e4c3e3c129fc9b31c81ce97905b99baaec6f0e61
-
SHA512
535a47f811f50784c3cd07e0f0aa7d729f913f7e9fedb09245d4ec0a5ba99b959cffbc3fc57de3c7b60c502b288978011250110bef663cf3811adbceb84970a8
-
SSDEEP
12288:sw/PU9GPU9q2RMgQW3e/OsBgo0q4wMle57NuXiEqPCIwmTSVYlessfLVL6GEf0pk:swk3e/OsBgo0q4wMl0urW4YNAL53Ef0e
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.newlogs2020.biz - Port:
587 - Username:
[email protected] - Password:
sgWpLKh0
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 6 IoCs
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2120aedbd73a301f04c000936d7ffd6d.exe"C:\Users\Admin\AppData\Local\Temp\2120aedbd73a301f04c000936d7ffd6d.exe"1⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oKLtdG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1564.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\2120aedbd73a301f04c000936d7ffd6d.exe"C:\Users\Admin\AppData\Local\Temp\2120aedbd73a301f04c000936d7ffd6d.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a477b13bef232a1bc943acd00c0dfd34
SHA112afb956ab0573a752d2713ff7ddc7fce6d2ae8a
SHA25671f534c3a260af3f5ec8e13c041d6881796f4b771120d7975b9eb3f59bc25c37
SHA512e0e79a0b473981acf1b4270e67a7a29d8dbf76517882659ed9500260f462b3ebc1f23543cecf23497f10f2ad27c515690b6725b5c0b27d5459caef1c44bb4ccf
-
Filesize
6.9MB
-
Filesize
776KB
-
Filesize
256KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
552KB
-
Filesize
264KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
6.9MB
-
Filesize
256KB