Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2023 13:34

General

  • Target

    b9778cf7d090f3c862267950655acb0608fe16f7d1892fd74e63c4f0f890e8fa.exe

  • Size

    1.0MB

  • MD5

    9d36688a27ffd790190faa7be7a89033

  • SHA1

    52aaf6053e42425a83b102c71ee559e7c049baba

  • SHA256

    b9778cf7d090f3c862267950655acb0608fe16f7d1892fd74e63c4f0f890e8fa

  • SHA512

    f848044036b86a44c3cd0de962cde0cb6da3b050e0cdc3cd0707434a81d3697059994330e10b6d5c2567ccde31dbdb1ac1907a304b7641103087868cb0c69cf2

  • SSDEEP

    24576:vmfmE0bk3oLIK2RjfjKZEZlelmwnFXXZmN:vmfmE0bk3oLIK2Rj4ECmh

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9778cf7d090f3c862267950655acb0608fe16f7d1892fd74e63c4f0f890e8fa.exe
    "C:\Users\Admin\AppData\Local\Temp\b9778cf7d090f3c862267950655acb0608fe16f7d1892fd74e63c4f0f890e8fa.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1380
        3⤵
        • Program crash
        PID:4080
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4872 -ip 4872
    1⤵
      PID:3440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3308-8-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/3308-6-0x0000000006190000-0x00000000061DC000-memory.dmp

      Filesize

      304KB

    • memory/3308-2-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/3308-3-0x0000000005E10000-0x0000000005E68000-memory.dmp

      Filesize

      352KB

    • memory/3308-1-0x0000000000070000-0x0000000000182000-memory.dmp

      Filesize

      1.1MB

    • memory/3308-5-0x0000000006140000-0x0000000006180000-memory.dmp

      Filesize

      256KB

    • memory/3308-0-0x00000000745D0000-0x0000000074D80000-memory.dmp

      Filesize

      7.7MB

    • memory/3308-7-0x00000000745D0000-0x0000000074D80000-memory.dmp

      Filesize

      7.7MB

    • memory/3308-4-0x0000000005FE0000-0x0000000006020000-memory.dmp

      Filesize

      256KB

    • memory/3308-9-0x00000000067F0000-0x0000000006D94000-memory.dmp

      Filesize

      5.6MB

    • memory/3308-13-0x00000000745D0000-0x0000000074D80000-memory.dmp

      Filesize

      7.7MB

    • memory/4872-14-0x00000000745D0000-0x0000000074D80000-memory.dmp

      Filesize

      7.7MB

    • memory/4872-15-0x0000000005040000-0x0000000005050000-memory.dmp

      Filesize

      64KB

    • memory/4872-16-0x0000000004F80000-0x0000000004FE6000-memory.dmp

      Filesize

      408KB

    • memory/4872-11-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/4872-17-0x00000000745D0000-0x0000000074D80000-memory.dmp

      Filesize

      7.7MB