Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/05/2024, 01:02
General
- Target 3a63d678ce5318dce83c3ebabe2daad7fae4b324f6dabeb7199719a464313ad8.exe
- Size 720KB
- Sample240521-bdybysda37
- SHA256 3a63d678ce5318dce83c3ebabe2daad7fae4b324f6dabeb7199719a464313ad8
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
emidco.com
-
Port
587
-
Username
-
Password
DMmpPxx9c
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a63d678ce5318dce83c3ebabe2daad7fae4b324f6dabeb7199719a464313ad8.exe"C:\Users\Admin\AppData\Local\Temp\3a63d678ce5318dce83c3ebabe2daad7fae4b324f6dabeb7199719a464313ad8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1036-10-0x0000000006C30000-0x0000000006CB2000-memory.dmp
memory/1036-11-0x000000000A6F0000-0x000000000A78C000-memory.dmp
memory/1036-2-0x0000000005EC0000-0x0000000006464000-memory.dmp
memory/1036-3-0x0000000005650000-0x00000000056E2000-memory.dmp
memory/1036-4-0x00000000055E0000-0x00000000055EA000-memory.dmp
memory/1036-5-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/1036-6-0x0000000005910000-0x00000000059CA000-memory.dmp
memory/1036-7-0x0000000005DF0000-0x0000000005E12000-memory.dmp
memory/1036-8-0x00000000059D0000-0x00000000059DC000-memory.dmp
memory/1036-9-0x0000000002EF0000-0x0000000002F00000-memory.dmp
memory/1036-1-0x0000000000C70000-0x0000000000D2A000-memory.dmp
memory/1036-12-0x000000007465E000-0x000000007465F000-memory.dmp
memory/1036-0-0x000000007465E000-0x000000007465F000-memory.dmp
memory/1036-13-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/1036-16-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/3920-14-0x0000000000400000-0x0000000000440000-memory.dmp
memory/3920-17-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/3920-19-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/3920-18-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/3920-20-0x00000000067A0000-0x00000000067F0000-memory.dmp
memory/3920-21-0x0000000074650000-0x0000000074E00000-memory.dmp