Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/02/2025, 14:28
General
- Target c468d6cb6039f6e7bf2150bcf9834e5d42e302129ee5147ac5273b9ae5d009df.exe
- Size 1019KB
- Sample250207-rs412strcv
- SHA256 c468d6cb6039f6e7bf2150bcf9834e5d42e302129ee5147ac5273b9ae5d009df
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
srv.masternic.net
-
Port
587
-
Username
-
Password
-H{2Szxi!%qb
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c468d6cb6039f6e7bf2150bcf9834e5d42e302129ee5147ac5273b9ae5d009df.exe"C:\Users\Admin\AppData\Local\Temp\c468d6cb6039f6e7bf2150bcf9834e5d42e302129ee5147ac5273b9ae5d009df.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\c468d6cb6039f6e7bf2150bcf9834e5d42e302129ee5147ac5273b9ae5d009df.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1624-11-0x0000000000CE0000-0x00000000010E0000-memory.dmp
memory/3424-12-0x0000000000340000-0x0000000000380000-memory.dmp
memory/3424-13-0x00000000743FE000-0x00000000743FF000-memory.dmp
memory/3424-14-0x00000000051C0000-0x0000000005764000-memory.dmp
memory/3424-15-0x0000000004DC0000-0x0000000004E26000-memory.dmp
memory/3424-16-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/3424-17-0x0000000005CC0000-0x0000000005D10000-memory.dmp
memory/3424-18-0x0000000005DB0000-0x0000000005E42000-memory.dmp
memory/3424-19-0x0000000005D60000-0x0000000005D6A000-memory.dmp
memory/3424-20-0x00000000743FE000-0x00000000743FF000-memory.dmp
memory/3424-21-0x00000000743F0000-0x0000000074BA0000-memory.dmp