Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 08:13
General
-
Target
TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe
-
Size
2.5MB
-
MD5
943b8ec27c9e3997239b317f081ec3e4
-
SHA1
c5d9639dfbda1c3fec0f7e7ff9c27790074c0009
-
SHA256
09ec4ca4e05a633b0a8114607cc08fd062348051d17f745d483cc3646279722b
-
SHA512
7eaf696ca9448de6363903749ef5d3fdb396190b656e8e87f4874a2a00ad19cd5725b072e1514dd90c4ff73eea590629b4e82b5fc084233aba4c44fbde7db490
-
SSDEEP
49152:ZP6hSrcCPT0J5Lg31+mYGnKDkTXzTnSPb:iujmmYGnKDkTzTno
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe"C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
7.7MB