makeve.exe

General
Target

makeve.exe

Filesize

136KB

Completed

25-03-2020 18:15

Score
10 /10
MD5

9fed11cd0c0bc367b30b08650dfba78f

SHA1

48ef476625cdbc1f74b83841ffc89e4b46615d05

SHA256

c7c2e3e6dc40ec793635b6f18e44223d8cbf9fb621ee0d5b374b709510fe2d9a

Malware Config
Signatures 8

Filter: none

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    Tags

  • Suspicious use of NtSetInformationThreadHideFromDebugger
    makeve.exeRegAsm.exe

    Reported IOCs

    pidprocess
    1856makeve.exe
    1872RegAsm.exe
    1872RegAsm.exe
  • Suspicious use of SetThreadContext
    makeve.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1856 set thread context of 18721856makeve.exeRegAsm.exe
  • Suspicious behavior: EnumeratesProcesses
    RegAsm.exe

    Reported IOCs

    pidprocess
    1872RegAsm.exe
    1872RegAsm.exe
  • Suspicious behavior: MapViewOfSection
    makeve.exe

    Reported IOCs

    pidprocess
    1856makeve.exe
  • Suspicious use of AdjustPrivilegeToken
    RegAsm.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1872RegAsm.exe
  • Suspicious use of SetWindowsHookEx
    makeve.exe

    Reported IOCs

    pidprocess
    1856makeve.exe
  • Suspicious use of WriteProcessMemory
    makeve.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1856 wrote to memory of 18721856makeve.exeRegAsm.exe
    PID 1856 wrote to memory of 18721856makeve.exeRegAsm.exe
    PID 1856 wrote to memory of 18721856makeve.exeRegAsm.exe
    PID 1856 wrote to memory of 18721856makeve.exeRegAsm.exe
    PID 1856 wrote to memory of 18721856makeve.exeRegAsm.exe
    PID 1856 wrote to memory of 18721856makeve.exeRegAsm.exe
    PID 1856 wrote to memory of 18721856makeve.exeRegAsm.exe
    PID 1856 wrote to memory of 18721856makeve.exeRegAsm.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\makeve.exe
    "C:\Users\Admin\AppData\Local\Temp\makeve.exe"
    Suspicious use of NtSetInformationThreadHideFromDebugger
    Suspicious use of SetThreadContext
    Suspicious behavior: MapViewOfSection
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\makeve.exe"
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1872
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads