Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
05-12-2023 17:39
General
-
Target
Fix+FakePing.exe
-
Size
2.0MB
-
MD5
09180bbf5b0074e7ed2d11f32b23eae9
-
SHA1
f020ec15817c9f88c6e20629be36cc14d8b44a43
-
SHA256
352e6c939b78c0a3b7e4d393cc5f0d62c7fec44ece9f740e71e71ed560324910
-
SHA512
97ba65c9194c817641c834fff79c33eb07894b4c3cadfe2e56f151f40f864acfba899188a1f28b2541295e3c7602276270f5e00ff5259d9f25e81b6e97507076
-
SSDEEP
24576:84dBWQr0lpY8K/IZgCJbQzdQALMSCYP2ElX1QmrJPR1+dyEGNos0j6mDg1:9ApYxUbQzdQAAYP5r9PR0+u
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fix+FakePing.exe"C:\Users\Admin\AppData\Local\Temp\Fix+FakePing.exe"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
888KB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB