Analysis
-
max time kernel
109s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
09-12-2023 16:46
General
-
Target
acidchanger0.26.1.exe
-
Size
1.8MB
-
MD5
fd989914536fbbbee6af24538369a07b
-
SHA1
b418015fc889b28dbf21a5d9ac8e04020766e947
-
SHA256
82406d68e65149769c2346162bcd358e89e7fcb54ae346f63f2eaa852426d5ed
-
SHA512
873918513634b19554cbed589b12fb64e6ddcd36efac3e3b3e30fccb384050951aec28c421caa6b90296be284c69de0034e74b43bf420222746bf04c40171bc9
-
SSDEEP
24576:0PSZ6uf+02A6fC9LtSRwY83GGB9Ve9weCaqVYzoX9oBYbFpfuLbzEy0QMpTpq:hZUbfC9psGBDe9D+VLtoBYzWPZzoTpq
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\acidchanger0.26.1.exe"C:\Users\Admin\AppData\Local\Temp\acidchanger0.26.1.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
72KB
-
Filesize
104KB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
10.8MB