Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
17-04-2024 01:53
General
-
Target
YENİ SİPARİŞ PO .2024.exe
-
Size
650KB
-
MD5
529a483f705a652ad2943e48f22cc037
-
SHA1
b93f46e467c2f620884a9afdd70aaf8e0b6f65e7
-
SHA256
7b360b7d9ecc11f7eac58a50bca9abbb0ffcafb81df863eb24190d32fd3c6de6
-
SHA512
934c93a9a38fb64b768ad84f259af5b92710b86498076e2139d218af256da6168150ad94c48471eab17265c5bcdf033ef1076ce0297c4e2af9ad618957289301
-
SSDEEP
12288:daAvWzT370N692rKClw/znsMxiMDH+hNT13k8LrMNT1DKjlLw:VN6UrKClynjiMDuzXMNhD2k
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.alfainterplast.com.ua - Port:
587 - Username:
[email protected] - Password:
pay2024password$$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs
-
Detects executables packed with SmartAssembly 1 IoCs
-
Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs
-
Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs
-
Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YENİ SİPARİŞ PO .2024.exe"C:\Users\Admin\AppData\Local\Temp\YENİ SİPARİŞ PO .2024.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\YENİ SİPARİŞ PO .2024.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
6.9MB
-
Filesize
520KB
-
Filesize
6.9MB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
256KB
-
Filesize
672KB