Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
11-12-2023 07:30
Static task
static1
Behavioral task
behavioral1
Sample
tmpnmki0idr.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
tmpnmki0idr.exe
Resource
win10v2004-20231130-en
General
-
Target
tmpnmki0idr.exe
-
Size
343KB
-
MD5
5aa23d8b62564d941b9280e3e6a4a7f7
-
SHA1
05982135347d56efb1009e25f59bb334bcc0ee9f
-
SHA256
2e8cc38f3632a65650d4cb44f5c9b66b5a31e9e431f21a67615a3566a3f0cb9e
-
SHA512
f831f2648e211c1c32348a13f9d465371b7581828d5eea339a957c5fb76718ee04654ba7832f53ae6eb7d01fdd558c35b73bdc99559b6a31986bef38d36a7a82
-
SSDEEP
6144:RMtupv8mx9piku5erIF9XCA2RO0F8S9hIlS8VPR5PJ9+fZmTDmv6MZRQtSYvbQnf:RMMpvJ/k35eUnN2Q0F8Whn8V55/2OCvw
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1183413987946274836/x2mGL5RsDliW33UcztWPXWKu2_GrASEJKuUh8AEd9kIV3tIOo9lsaMizqXjKhhr_O01m
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmpnmki0idr.exedescription pid process target process PID 1712 set thread context of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
tmpnmki0idr.exedescription pid process target process PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe PID 1712 wrote to memory of 2508 1712 tmpnmki0idr.exe tmpnmki0idr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpnmki0idr.exe"C:\Users\Admin\AppData\Local\Temp\tmpnmki0idr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\tmpnmki0idr.exe"C:\Users\Admin\AppData\Local\Temp\tmpnmki0idr.exe"2⤵PID:2508