Analysis

  • max time kernel
    52s
  • max time network
    74s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2023 16:51

General

  • Target

    u1zBYqsipafStki.exe

  • Size

    848KB

  • MD5

    0d3f3677ea8d45a57d725d61c71c172b

  • SHA1

    be4ca1e7e6a23784efce031f83c0232141cd0718

  • SHA256

    7c57d141f4c57d4ab30efd69206dc0a236ed915b2dbc437a9305b860e66e8a3c

  • SHA512

    6b4fd4ac87b2d64881986dacf956a1aa3ec8e7cb351cc58d512e5b48c61a1ee5b2e69b264e4b8ec549211f5a29b35eb883e3e2cf79decd89467a07c069f36226

  • SSDEEP

    12288:MaqvKgABiOX57dhpovj+6xuXvQDX7xRRVHZUvKeUtfysEa7ueH5qTIx:2OX5ZhSrXiQDFRRoZU5dEapq2

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6488735902:AAFjq98r8SzTcc0BHWZQiLUk749fQ78ULos/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\u1zBYqsipafStki.exe
    "C:\Users\Admin\AppData\Local\Temp\u1zBYqsipafStki.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Local\Temp\u1zBYqsipafStki.exe
      "C:\Users\Admin\AppData\Local\Temp\u1zBYqsipafStki.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5084
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:4612
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
        PID:4740

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2196-12-0x00000000056E0000-0x00000000056F0000-memory.dmp

        Filesize

        64KB

      • memory/2196-7-0x00000000067A0000-0x00000000067A8000-memory.dmp

        Filesize

        32KB

      • memory/2196-0-0x0000000000930000-0x0000000000A0A000-memory.dmp

        Filesize

        872KB

      • memory/2196-3-0x0000000005470000-0x0000000005502000-memory.dmp

        Filesize

        584KB

      • memory/2196-4-0x00000000056E0000-0x00000000056F0000-memory.dmp

        Filesize

        64KB

      • memory/2196-5-0x0000000005410000-0x000000000541A000-memory.dmp

        Filesize

        40KB

      • memory/2196-6-0x0000000006760000-0x000000000677A000-memory.dmp

        Filesize

        104KB

      • memory/2196-1-0x00000000749C0000-0x0000000075170000-memory.dmp

        Filesize

        7.7MB

      • memory/2196-8-0x00000000067B0000-0x00000000067BA000-memory.dmp

        Filesize

        40KB

      • memory/2196-9-0x0000000008130000-0x00000000081AE000-memory.dmp

        Filesize

        504KB

      • memory/2196-10-0x000000000A890000-0x000000000A92C000-memory.dmp

        Filesize

        624KB

      • memory/2196-11-0x00000000749C0000-0x0000000075170000-memory.dmp

        Filesize

        7.7MB

      • memory/2196-2-0x0000000005940000-0x0000000005EE4000-memory.dmp

        Filesize

        5.6MB

      • memory/2196-16-0x00000000749C0000-0x0000000075170000-memory.dmp

        Filesize

        7.7MB

      • memory/4740-20-0x00000220C7F60000-0x00000220C7F70000-memory.dmp

        Filesize

        64KB

      • memory/4740-52-0x00000220D03D0000-0x00000220D03D1000-memory.dmp

        Filesize

        4KB

      • memory/4740-36-0x00000220C8060000-0x00000220C8070000-memory.dmp

        Filesize

        64KB

      • memory/4740-56-0x00000220D0510000-0x00000220D0511000-memory.dmp

        Filesize

        4KB

      • memory/4740-55-0x00000220D0400000-0x00000220D0401000-memory.dmp

        Filesize

        4KB

      • memory/4740-54-0x00000220D0400000-0x00000220D0401000-memory.dmp

        Filesize

        4KB

      • memory/5084-18-0x00000000052C0000-0x0000000005326000-memory.dmp

        Filesize

        408KB

      • memory/5084-17-0x00000000051B0000-0x00000000051C0000-memory.dmp

        Filesize

        64KB

      • memory/5084-15-0x00000000749C0000-0x0000000075170000-memory.dmp

        Filesize

        7.7MB

      • memory/5084-19-0x00000000067A0000-0x00000000067F0000-memory.dmp

        Filesize

        320KB

      • memory/5084-58-0x00000000051B0000-0x00000000051C0000-memory.dmp

        Filesize

        64KB

      • memory/5084-57-0x00000000749C0000-0x0000000075170000-memory.dmp

        Filesize

        7.7MB

      • memory/5084-13-0x0000000000400000-0x0000000000444000-memory.dmp

        Filesize

        272KB