Overview

overview

10

Static

static

5

54aa062cdf...8c.exe

windows7-x64

10

54aa062cdf...8c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    298s
  • max time network
    331s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 08:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    54aa062cdf2608851a04e43b2e24d0449633f5c2f25d202f0a321d58a2a75b8c.exe

  • Size

    1.3MB

  • MD5

    6c47d7f12ec4b17a554eeaebfa9e57dd

  • SHA1

    370b78b3d7c65ddd2c74d1537a2cc7fbe753f5ab

  • SHA256

    54aa062cdf2608851a04e43b2e24d0449633f5c2f25d202f0a321d58a2a75b8c

  • SHA512

    508532656b1001aae03ac4831c450f9be903aed140f1327b34046b6155543da24483e37ee26edebbaced1b8624936584df8774148705ab3e8c9eae52acc23e34

  • SSDEEP

    24576:/AHnh+eWsN3skA4RV1Hom2KXMmHa2DAoNUGN1RDKqlcrMcVSZPpK+c5:ih+ZkldoPK8Ya2DAMUGlmjMUYPpKt

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54aa062cdf2608851a04e43b2e24d0449633f5c2f25d202f0a321d58a2a75b8c.exe
    "C:\Users\Admin\AppData\Local\Temp\54aa062cdf2608851a04e43b2e24d0449633f5c2f25d202f0a321d58a2a75b8c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
        PID:2724

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2724-132-0x0000000000000000-mapping.dmp
      Download
    • memory/2724-133-0x0000000000800000-0x0000000000850000-memory.dmp
      Filesize

      320KB

      Download
    • memory/2724-138-0x00000000735C0000-0x0000000073B71000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2724-139-0x00000000735C0000-0x0000000073B71000-memory.dmp
      Filesize

      5.7MB

      Download