Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
23/08/2023, 17:05
General
-
Target
download.exe
-
Size
537KB
-
MD5
ec6eda82feb05fd53bd91e09d81c4851
-
SHA1
4e1178949d6d5ee4bc6edb2ca3a5b01cbb0145bd
-
SHA256
a9f6936360b94b07c20351aba6fe85b4c6c36b237437612bc35165fce4294faf
-
SHA512
9f59ca532d033ea99cea0b5d139a024a28326bc19a99348fa98e60ee308688164083c8481b6cdad0d46876a9face1e224ff50e5b7c4e0cf1190d4df6d52a52e9
-
SSDEEP
6144:o7A+44sibrdECvehEkJ8oLHkwwETkzTzTETrHSSPLjgW4g+Ehf:sA+YobvehtLYETkzTzTETrH7LjzJh
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
560KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB