General
-
Target
docgen20230925.exe
-
Size
1.1MB
-
Sample
230926-q8fgyshg61
-
MD5
72f02b6a2b8fd2a73ae8715fcc2323ca
-
SHA1
d840ba097b8a157a86b823e4132818a122125381
-
SHA256
b0fbd35f04ce341b8e14ad03684aa7a5fbc7525d163f38bf43a0f6041edeb3c8
-
SHA512
c6b6c54e525503f89395fd76be6f54bf2c898c151a32252ac1e4d04cd39f383992726c43e615cfa149777513bc3fc18b8bd5ce4f73f86f179ee70ef9f4e2b847
-
SSDEEP
24576:CMIwO43ryC3ASF+7Azwr2skstJ6Y2Qc6ZsifO41JdlEQgeGsWML2l:Cu3Ax71rFnJl2Qct8zdltYsW3l
Static task
static1
Behavioral task
behavioral1
Sample
docgen20230925.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
docgen20230925.exe
Resource
win10v2004-20230915-en
Malware Config
Targets
-
-
Target
docgen20230925.exe
-
Size
1.1MB
-
MD5
72f02b6a2b8fd2a73ae8715fcc2323ca
-
SHA1
d840ba097b8a157a86b823e4132818a122125381
-
SHA256
b0fbd35f04ce341b8e14ad03684aa7a5fbc7525d163f38bf43a0f6041edeb3c8
-
SHA512
c6b6c54e525503f89395fd76be6f54bf2c898c151a32252ac1e4d04cd39f383992726c43e615cfa149777513bc3fc18b8bd5ce4f73f86f179ee70ef9f4e2b847
-
SSDEEP
24576:CMIwO43ryC3ASF+7Azwr2skstJ6Y2Qc6ZsifO41JdlEQgeGsWML2l:Cu3Ax71rFnJl2Qct8zdltYsW3l
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-