Analysis
-
max time kernel
41s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 01:09
General
-
Target
1f64a1fccb2ccf2a7b3b8bd3fd40b3c3.exe
-
Size
1.1MB
-
MD5
1f64a1fccb2ccf2a7b3b8bd3fd40b3c3
-
SHA1
abf690443bf75433e86c565cc7c0ffb3ee56d67c
-
SHA256
1fbfc85cb0739606eda3aa7ee754fd438ad9b24c4d674dac6db8864de954ef62
-
SHA512
93e8fc26e969753a9f5c8799aa3a9a79a719cce655fc91c4f344a8cba9dc32537583574dcac55213177d8bbfdc6a6ed23a604b1406c4d4ad79ea9a124277ac4b
-
SSDEEP
12288:9zlh2ZZpCKmnA8ebZj5/dDXPUAvoZnW5lHH4Qsex0XAByK9dbIMXVXN1edOO4ADs:Z29mnA8IZj5/dDlkWf494cg59rrKx4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
@#yandel@>20$
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f64a1fccb2ccf2a7b3b8bd3fd40b3c3.exe"C:\Users\Admin\AppData\Local\Temp\1f64a1fccb2ccf2a7b3b8bd3fd40b3c3.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\1f64a1fccb2ccf2a7b3b8bd3fd40b3c3.exe"C:\Users\Admin\AppData\Local\Temp\1f64a1fccb2ccf2a7b3b8bd3fd40b3c3.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1f64a1fccb2ccf2a7b3b8bd3fd40b3c3.exe"C:\Users\Admin\AppData\Local\Temp\1f64a1fccb2ccf2a7b3b8bd3fd40b3c3.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BavckLWtTsWaPN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFACB.tmp"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
344KB
-
Filesize
320KB
-
Filesize
96KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB