Analysis
-
max time kernel
41s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
02-12-2023 14:42
General
-
Target
MONSTERMCProtector.zip
-
Size
2.9MB
-
MD5
e8a8b0cab9eb9a710fd7895ff764cc99
-
SHA1
39bc39ee525a3e4c3d18fd5fb07cb15463fbc701
-
SHA256
98c8e17db7c4e1f5cac1d3f8487e984802bb436a52620667d0c2ff602a6b1789
-
SHA512
d7f14f6c57bb93748fff6f6f028955a20423cc184deb8e3427b79a3262944c7f26a0d4cfe626d16be1fddc53f104ce16610baf4cd72eb7224619248299dd55e2
-
SSDEEP
49152:6btLYS4beqTlCIuvYiV5G+NxFczKZZsy6nqvJD5tlQLmd:6bRYS4CqTxYYiVk+NxFjZsylhDVjd
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 4 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MONSTERMCProtector.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MONSTERMCProtector.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\MONSTERMCProtectorGUI.exe"C:\Users\Admin\Desktop\MONSTERMCProtectorGUI.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD51915011997fdb9aa95f15e567f4e6070
SHA140a7853f14d6d4919279965f026d57cf9a104998
SHA256952fa59d3d6d8c8c5fad8a1144e5effdf0fa92d58db1fb2a2899faf84c6273ab
SHA5125cca71b42ed9dc154e6d5919e7cd93046168781a55c051818157848efc918b2e4dd92f422eb1c47e0940b645ba750facf83bce240748a8170ac8ce0afc9efa90
-
Filesize
1.9MB
MD51915011997fdb9aa95f15e567f4e6070
SHA140a7853f14d6d4919279965f026d57cf9a104998
SHA256952fa59d3d6d8c8c5fad8a1144e5effdf0fa92d58db1fb2a2899faf84c6273ab
SHA5125cca71b42ed9dc154e6d5919e7cd93046168781a55c051818157848efc918b2e4dd92f422eb1c47e0940b645ba750facf83bce240748a8170ac8ce0afc9efa90
-
Filesize
1.9MB
MD51915011997fdb9aa95f15e567f4e6070
SHA140a7853f14d6d4919279965f026d57cf9a104998
SHA256952fa59d3d6d8c8c5fad8a1144e5effdf0fa92d58db1fb2a2899faf84c6273ab
SHA5125cca71b42ed9dc154e6d5919e7cd93046168781a55c051818157848efc918b2e4dd92f422eb1c47e0940b645ba750facf83bce240748a8170ac8ce0afc9efa90
-
Filesize
1.9MB
MD5c72df757360695c826568dabe81987cd
SHA1faf62ab24546de59d2c1c66798ac29e4ef40e0a9
SHA25671f158807ec5be64dbdddeeaa761c589c6f9dd02806155169af38e8d2d77bb21
SHA512d4592216164e8af8083383304483b4403d0dde827c3b71be547515730d3dd0584b2262629d1361feea01722a70c6dc54dacd3359507508a036a2de4788ace7d6
-
Filesize
1.9MB
MD5c72df757360695c826568dabe81987cd
SHA1faf62ab24546de59d2c1c66798ac29e4ef40e0a9
SHA25671f158807ec5be64dbdddeeaa761c589c6f9dd02806155169af38e8d2d77bb21
SHA512d4592216164e8af8083383304483b4403d0dde827c3b71be547515730d3dd0584b2262629d1361feea01722a70c6dc54dacd3359507508a036a2de4788ace7d6
-
Filesize
584KB
-
Filesize
344KB
-
Filesize
960KB
-
Filesize
8KB
-
Filesize
6.0MB
-
Filesize
624KB
-
Filesize
192KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
960KB
-
Filesize
40KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
2.0MB
-
Filesize
6.0MB
-
Filesize
64KB
-
Filesize
6.0MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
6.0MB
-
Filesize
960KB