Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
03/06/2024, 14:17
General
- Target 50e85468becf2a5b858a1cd14362899128ccda25c01b428f52ddc033bb95ad65.exe
- Size 668KB
- Sample240603-rlpmsaae84
- SHA256 50e85468becf2a5b858a1cd14362899128ccda25c01b428f52ddc033bb95ad65
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.medicoscience.ro
-
Port
587
-
Username
-
Password
Ms@0001
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50e85468becf2a5b858a1cd14362899128ccda25c01b428f52ddc033bb95ad65.exe"C:\Users\Admin\AppData\Local\Temp\50e85468becf2a5b858a1cd14362899128ccda25c01b428f52ddc033bb95ad65.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3148-13-0x0000000000400000-0x0000000000440000-memory.dmp
memory/3148-20-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3148-19-0x0000000005FA0000-0x0000000005FF0000-memory.dmp
memory/3148-18-0x0000000005070000-0x00000000050D6000-memory.dmp
memory/3148-17-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3148-16-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3528-5-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3528-6-0x0000000005740000-0x0000000005756000-memory.dmp
memory/3528-8-0x0000000006420000-0x0000000006430000-memory.dmp
memory/3528-9-0x0000000006490000-0x0000000006512000-memory.dmp
memory/3528-10-0x0000000008C40000-0x0000000008CDC000-memory.dmp
memory/3528-11-0x0000000074CDE000-0x0000000074CDF000-memory.dmp
memory/3528-12-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3528-7-0x0000000006410000-0x000000000641C000-memory.dmp
memory/3528-15-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3528-0-0x0000000074CDE000-0x0000000074CDF000-memory.dmp
memory/3528-4-0x00000000053E0000-0x00000000053EA000-memory.dmp
memory/3528-3-0x0000000005240000-0x00000000052D2000-memory.dmp
memory/3528-2-0x0000000005750000-0x0000000005CF4000-memory.dmp
memory/3528-1-0x0000000000790000-0x000000000083C000-memory.dmp