Analysis
-
max time kernel
81s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
08/06/2023, 02:19
General
-
Target
Eclipse BETA.exe
-
Size
22KB
-
MD5
ba7c345c6f2ec9b18a453c7382436737
-
SHA1
9e70e12a61c1ba3b01d41fd8c7e670f697e423ba
-
SHA256
47cb13c367f9ea1388c908049382721b1760c257afce0b6443b338f25f3b4594
-
SHA512
20bc340362c715710ef2e0b98361e77f56ab866804c690d96cb4279666ecb3d070af816e93044b136e1b2470c7c7cf823f021a29b4c5713e2e2fe69068ee1e8e
-
SSDEEP
384:buZxaYaRziTKLHtwr0vHzUJKq6faofAHaPjTJxqd32Q0ASrzWXYAsZi6YT/r:buZk1zj/zwKqsa0hMd32Q01foYTSDr
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eclipse BETA.exe"C:\Users\Admin\AppData\Local\Temp\Eclipse BETA.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EclipseClient\Eclipse.exe"C:\Users\Admin\AppData\Local\Temp\EclipseClient\Eclipse.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
64KB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
2.0MB
-
Filesize
32KB
-
Filesize
408KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
19.6MB
-
Filesize
64KB
-
Filesize
64KB