Analysis
-
max time kernel
57s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31-12-2023 06:03
General
-
Target
2b134be5c3d9c940c710adcf5f5e6b84.exe
-
Size
1.1MB
-
MD5
2b134be5c3d9c940c710adcf5f5e6b84
-
SHA1
95342605ed928e172f42593093b75d1f5cc652f7
-
SHA256
64a6309eb963fb0fbc26d0d1d8a370f2e9f554174a58f2e5bd254ecba31771f3
-
SHA512
ab008cf3458337fa11fb244afe17c93ad9314922a6ea86f1e30a52db153adeeabebe5bef4d1ccc1a6b7d4cca9c450e7dc1bfedaecd233ef51b5dbe41ab495917
-
SSDEEP
12288:EnK8jEyoS03dyvUIZbVIVZrbcemx7Y9JA226xLPNGsa9B3td3MTDS89dyP3fHvXy:E3jEyoSUgvDBIjcei7Y9g6R1g3bm
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cwtgroup.co.za - Port:
587 - Username:
[email protected] - Password:
$$$333### - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b134be5c3d9c940c710adcf5f5e6b84.exe"C:\Users\Admin\AppData\Local\Temp\2b134be5c3d9c940c710adcf5f5e6b84.exe"1⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PaZIIm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF077.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\2b134be5c3d9c940c710adcf5f5e6b84.exe"C:\Users\Admin\AppData\Local\Temp\2b134be5c3d9c940c710adcf5f5e6b84.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
504KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
248KB
-
Filesize
1.1MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
136KB