Analysis
- max time kernel
90s - max time network
91s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
03/02/2024, 16:48
General
- Target Bill of Lading_commercial invoice_.exe
- Size 1.0MB
- Sample240203-va4t4sgbdn
- SHA256 8ac735dccc5ce2e992b3b9682b244e24aa7485c71c345620db4e5f2e79640ef6
Malware Config
Extracted
-
agenttesla
-
https://discord.com/api/webhooks/1202330946817237022/1d5Ynow6yHbMqcRfr75qQjJVcSQnFlKpV4g5H2hHiKoRW33XeyZHnl-7hxdTf95oiy9f
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bill of Lading_commercial invoice_.exe"C:\Users\Admin\AppData\Local\Temp\Bill of Lading_commercial invoice_.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3052-10-0x0000000005390000-0x00000000053F6000-memory.dmp
memory/3052-13-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/3052-14-0x0000000005310000-0x0000000005320000-memory.dmp
memory/3052-8-0x0000000005790000-0x0000000005D34000-memory.dmp
memory/3052-4-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3052-12-0x0000000006550000-0x000000000655A000-memory.dmp
memory/3052-9-0x0000000005310000-0x0000000005320000-memory.dmp
memory/3052-7-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/3052-11-0x0000000006570000-0x0000000006602000-memory.dmp
memory/4892-0-0x0000000000080000-0x0000000000190000-memory.dmp
memory/4892-1-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/4892-6-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/4892-3-0x0000000004B90000-0x0000000004BA0000-memory.dmp
memory/4892-2-0x0000000002620000-0x000000000262A000-memory.dmp