Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 02:08

General

  • Target

    4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe

  • Size

    580KB

  • MD5

    e3f571bd6aea26e6f2721cd147e3aeac

  • SHA1

    3cffb12aeebff9c1260b333c980a028f2403c677

  • SHA256

    4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965

  • SHA512

    1cfdf95374a749e44ca3fb488ca2ce9fa52a60bf50d9d21f5df1ee5927d0a7fb8ef5d24c6f65b4fd6c4cb893ff97e3a1cdc5201b288619d670425ccbb382123f

  • SSDEEP

    12288:eDYaW1FIIt8pBFlCVvAFCVMEBJ1UN5sg8YbbWKBQ:eDYr1Fxt8L5FgLSH8Y

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.nsatech.co
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Hn064008007320212021

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe
    "C:\Users\Admin\AppData\Local\Temp\4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4004-6-0x0000000005210000-0x0000000005276000-memory.dmp

    Filesize

    408KB

  • memory/4004-10-0x0000000006200000-0x000000000629C000-memory.dmp

    Filesize

    624KB

  • memory/4004-14-0x0000000074BF0000-0x00000000753A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4004-3-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/4004-4-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

    Filesize

    4KB

  • memory/4004-5-0x0000000005750000-0x0000000005CF4000-memory.dmp

    Filesize

    5.6MB

  • memory/4004-13-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

    Filesize

    4KB

  • memory/4004-12-0x0000000006560000-0x000000000656A000-memory.dmp

    Filesize

    40KB

  • memory/4004-11-0x00000000065C0000-0x0000000006652000-memory.dmp

    Filesize

    584KB

  • memory/4004-9-0x0000000006110000-0x0000000006160000-memory.dmp

    Filesize

    320KB

  • memory/4004-7-0x0000000074BF0000-0x00000000753A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4980-1-0x00007FFFAE803000-0x00007FFFAE805000-memory.dmp

    Filesize

    8KB

  • memory/4980-8-0x00007FFFAE800000-0x00007FFFAF2C1000-memory.dmp

    Filesize

    10.8MB

  • memory/4980-0-0x000001CD261A0000-0x000001CD26236000-memory.dmp

    Filesize

    600KB

  • memory/4980-2-0x00007FFFAE800000-0x00007FFFAF2C1000-memory.dmp

    Filesize

    10.8MB