Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
11-12-2023 13:25
General
-
Target
39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe
-
Size
240KB
-
MD5
285c79216d7884f1cd6514c04f16357b
-
SHA1
5e877ad4900eb68a8ae16fb96232eaa0dfc1b09b
-
SHA256
39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e
-
SHA512
c4797ec6efe546458a2d054ae2bec0bae3e1ed56e74e86fe13ce8c5c3a22d1ed1cedc15c54bbf7b101015699d64ce41151ff5887cd23139a1798c9c71e540d81
-
SSDEEP
3072:0tYHr3aD32duqAFjnmy5gB6njp8P6OUqHMeK:0tYHr3aD32duqKjmN6j2Q
Score
10/10
Malware Config
Extracted
Family
agenttesla
C2
https://api.telegram.org/bot6471053992:AAFUlrUxhi5Jrpjikoc-P4r9ZbsXV_T9vj8/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe"C:\Users\Admin\AppData\Local\Temp\39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 14322⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB