Analysis
-
max time kernel
1s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
07-12-2023 08:04
General
-
Target
Banco BPM Payment _Receipt.bat.exe
-
Size
6KB
-
MD5
6aa5d99f2f18d3655ae0d62884f951fe
-
SHA1
70286e62ebdb15b55c6cca8058da53af14aaf6a3
-
SHA256
7509bbea073fad9c718e4d7b32cec61c2288e6ecb2e3e6a29e5c203fded3f189
-
SHA512
e1a14f6e2403a3222a715e0dc11cbf2c1491b500db889de9fb1148b22e73cb3271a2ebb291b89c7b11f1ced01573bdd2e5d9d802ad89618e3dfa4ef2ed900f7f
-
SSDEEP
96:3mG46M9ifUo5OUPBvcQsTYQePn7yLHtPzNt:3V46M9if2UPBiTYQsn7yLHn
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6883693519:AAHvfYKMVRwIIU52NeZnMffMkjYGUeESofU/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Banco BPM Payment _Receipt.bat.exe"C:\Users\Admin\AppData\Local\Temp\Banco BPM Payment _Receipt.bat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Banco BPM Payment _Receipt.bat.exe"C:\Users\Admin\AppData\Local\Temp\Banco BPM Payment _Receipt.bat.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5489c7565f9b029ba9fadff774073cc98
SHA156c05089b33ee7e7dfa9e6a2d098164efd8e1150
SHA25610bf6242da02dad8b2e1208b9dab9a7303cf986320e05e5ef20b99c9b71326d4
SHA512ddea09c011a8d4f85905842c2f34c98add0110a0b6b3b2709718c3614a2c42dec5f4f5d5b9442cfd3c6c23e9a90c8c0b25c14c3dbd42faea9cc8dd232cace1ac
-
Filesize
624KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
360KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
7.7MB