Analysis
- max time kernel
147s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
19/03/2024, 07:31
General
- Target DEKONT-90486589368903087689000000000000065.exe
- Size 337KB
- Sample240319-jcdj6ade99
- SHA256 660f2be2087d54741e99ef96df97b3d942b1a28e98bf9cc75109930111f7da87
Malware Config
Extracted
-
Protocol
ftp
-
Host
ftp.normagroup.com.tr
-
Port
21
-
Username
-
Password
Kingdom12345@
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.normagroup.com.tr
-
Port
21
-
Username
-
Password
Kingdom12345@
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DEKONT-90486589368903087689000000000000065.exe"C:\Users\Admin\AppData\Local\Temp\DEKONT-90486589368903087689000000000000065.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/336-11-0x00000000052E0000-0x00000000052F0000-memory.dmp
memory/336-17-0x00000000052E0000-0x00000000052F0000-memory.dmp
memory/336-16-0x00000000752F0000-0x0000000075AA0000-memory.dmp
memory/336-15-0x0000000006740000-0x000000000674A000-memory.dmp
memory/336-14-0x0000000006120000-0x00000000061BC000-memory.dmp
memory/336-7-0x0000000000400000-0x0000000000440000-memory.dmp
memory/336-10-0x00000000752F0000-0x0000000075AA0000-memory.dmp
memory/336-13-0x0000000006030000-0x0000000006080000-memory.dmp
memory/336-12-0x0000000005270000-0x00000000052D6000-memory.dmp
memory/3640-4-0x0000000007180000-0x0000000007212000-memory.dmp
memory/3640-5-0x0000000004BC0000-0x0000000004BD0000-memory.dmp
memory/3640-6-0x0000000002510000-0x000000000251A000-memory.dmp
memory/3640-9-0x00000000752F0000-0x0000000075AA0000-memory.dmp
memory/3640-0-0x00000000752F0000-0x0000000075AA0000-memory.dmp
memory/3640-3-0x0000000007690000-0x0000000007C34000-memory.dmp
memory/3640-2-0x0000000004B30000-0x0000000004B86000-memory.dmp
memory/3640-1-0x00000000001B0000-0x000000000020A000-memory.dmp