Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2024 01:43

General

  • Target

    45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe

  • Size

    716KB

  • MD5

    64605be9d007ce3a0d7be5c2ac52b5bc

  • SHA1

    194b675d43243d9bc0826a6557018608e8fd1f39

  • SHA256

    45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4

  • SHA512

    b21fe3495cdcca49f19ffea6fbb72d2e3e168ae9feffaf47464b6221b51373bb188bdae05acad5165d94a8462b592c8f6d999db4e73e4dea9a39ea1ef9f0d19a

  • SSDEEP

    12288:zUQKt/rFfamKYqmdB9W1ZvuzxbWFBXOixQVHjJQ45vpSZ9qGdAJXAeYMxa/1mPfy:YQKN5imhqmP9KCoF9ED+gRS/wwh1F

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.ayrancimetal.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    CEBrPMJuCWPcB8xSLQnf

Extracted

Family

agenttesla

Credentials

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe
    "C:\Users\Admin\AppData\Local\Temp\45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4840-0-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

    Filesize

    4KB

  • memory/4840-1-0x0000000000590000-0x0000000000646000-memory.dmp

    Filesize

    728KB

  • memory/4840-2-0x00000000056F0000-0x0000000005C94000-memory.dmp

    Filesize

    5.6MB

  • memory/4840-3-0x0000000005040000-0x00000000050D2000-memory.dmp

    Filesize

    584KB

  • memory/4840-4-0x00000000050E0000-0x00000000050EA000-memory.dmp

    Filesize

    40KB

  • memory/4840-5-0x0000000074D50000-0x0000000075500000-memory.dmp

    Filesize

    7.7MB

  • memory/4840-6-0x0000000005350000-0x0000000005366000-memory.dmp

    Filesize

    88KB

  • memory/4840-7-0x00000000062A0000-0x00000000062AE000-memory.dmp

    Filesize

    56KB

  • memory/4840-8-0x00000000062C0000-0x00000000062D0000-memory.dmp

    Filesize

    64KB

  • memory/4840-9-0x0000000006300000-0x0000000006384000-memory.dmp

    Filesize

    528KB

  • memory/4840-10-0x000000000A670000-0x000000000A70C000-memory.dmp

    Filesize

    624KB

  • memory/4840-11-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

    Filesize

    4KB

  • memory/4840-12-0x0000000074D50000-0x0000000075500000-memory.dmp

    Filesize

    7.7MB

  • memory/4840-13-0x0000000004A80000-0x0000000004AC2000-memory.dmp

    Filesize

    264KB

  • memory/4840-14-0x0000000006420000-0x0000000006486000-memory.dmp

    Filesize

    408KB

  • memory/4840-15-0x0000000008410000-0x0000000008460000-memory.dmp

    Filesize

    320KB