Analysis
- max time kernel
120s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
- submitted
27/03/2025, 06:46
General
- Target OVERDUE ACCOUNT LETTER- FINAL REMINDER.exe
- Size 1.4MB
- Sample250327-hjmwqsyshs
- SHA256 f888c4770bbbbcad15c357d6731ff8f5afd7e62e4c35652f3dc3ede6c36b66e9
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.iaa-airferight.com
-
Port
587
-
Username
-
Password
BIGNAIRA2024
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Drops startup file 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\OVERDUE ACCOUNT LETTER- FINAL REMINDER.exe"C:\Users\Admin\AppData\Local\Temp\OVERDUE ACCOUNT LETTER- FINAL REMINDER.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2076-0-0x00000000751AE000-0x00000000751AF000-memory.dmp
memory/2076-1-0x0000000000DE0000-0x0000000000F42000-memory.dmp
memory/2076-2-0x0000000005FF0000-0x0000000006106000-memory.dmp
memory/2076-3-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2076-4-0x0000000006130000-0x0000000006244000-memory.dmp
memory/2076-12-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-62-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-68-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-66-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-64-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-60-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-58-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-56-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-52-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-50-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-48-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-46-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-44-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-43-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-40-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-38-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-36-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-34-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-32-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-28-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-24-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-22-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-18-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-16-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-10-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-8-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-6-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-5-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-54-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-30-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-26-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-20-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-14-0x0000000006130000-0x000000000623D000-memory.dmp
memory/2076-1341-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2076-1342-0x0000000006410000-0x000000000647C000-memory.dmp
memory/2076-1343-0x0000000006500000-0x000000000656A000-memory.dmp
memory/2076-1344-0x00000000063B0000-0x00000000063FC000-memory.dmp
memory/2076-1345-0x00000000751AE000-0x00000000751AF000-memory.dmp
memory/2076-1346-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2076-1347-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2076-1348-0x0000000006DF0000-0x0000000007394000-memory.dmp
memory/2076-1349-0x00000000066E0000-0x0000000006734000-memory.dmp
memory/2076-1355-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2076-1358-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2076-1359-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3916-1360-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3916-1361-0x00000000007B0000-0x00000000007F0000-memory.dmp
memory/3916-1362-0x0000000004E10000-0x0000000004E76000-memory.dmp
memory/3916-1363-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3916-1364-0x0000000006220000-0x0000000006270000-memory.dmp
memory/3916-1365-0x0000000006310000-0x00000000063A2000-memory.dmp
memory/3916-1366-0x0000000006290000-0x000000000629A000-memory.dmp
memory/3916-1367-0x00000000751A0000-0x0000000075950000-memory.dmp