Analysis
- max time kernel
92s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
10/03/2025, 11:27
General
- Target eca76bae7cf6ffdfef6269b5eae8bca702663e3c2b7f7aca6b9d4d194276acca.exe
- Size 1.8MB
- Sample250310-nkj45aspx8
- SHA256 eca76bae7cf6ffdfef6269b5eae8bca702663e3c2b7f7aca6b9d4d194276acca
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
nffplp.com
-
Port
587
-
Username
-
Password
$Nke%8XIIDtm
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Drops startup file 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\eca76bae7cf6ffdfef6269b5eae8bca702663e3c2b7f7aca6b9d4d194276acca.exe"C:\Users\Admin\AppData\Local\Temp\eca76bae7cf6ffdfef6269b5eae8bca702663e3c2b7f7aca6b9d4d194276acca.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2652-1342-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-1345-0x0000000005020000-0x0000000005086000-memory.dmp
memory/2652-1346-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/2652-1344-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/2652-1347-0x0000000006320000-0x00000000063B2000-memory.dmp
memory/2652-1350-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/2652-1349-0x00000000065A0000-0x00000000065AA000-memory.dmp
memory/2652-1348-0x00000000063C0000-0x0000000006410000-memory.dmp
memory/3660-24-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-12-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-66-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-64-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-62-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-58-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-56-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-54-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-50-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-48-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-46-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-42-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-38-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-36-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-34-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-32-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-30-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-28-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-3-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-22-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-20-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-18-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-14-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-10-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-8-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-6-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-4-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-60-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-52-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-44-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-40-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-26-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-16-0x00000000056E0000-0x00000000057EC000-memory.dmp
memory/3660-1325-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3660-1326-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3660-1327-0x00000000058C0000-0x000000000592C000-memory.dmp
memory/3660-1328-0x0000000005A30000-0x0000000005A9A000-memory.dmp
memory/3660-1329-0x0000000005AD0000-0x0000000005B1C000-memory.dmp
memory/3660-1330-0x00000000062A0000-0x0000000006844000-memory.dmp
memory/3660-2-0x00000000056E0000-0x00000000057F2000-memory.dmp
memory/3660-1-0x0000000000B40000-0x0000000000D1E000-memory.dmp
memory/3660-0-0x0000000074CDE000-0x0000000074CDF000-memory.dmp
memory/3660-1331-0x0000000005BC0000-0x0000000005C14000-memory.dmp
memory/3660-1337-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3660-1339-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3660-1341-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3660-1343-0x0000000074CD0000-0x0000000075480000-memory.dmp