Analysis
- max time kernel
117s - max time network
124s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
06/02/2024, 15:22
General
- Target 46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe
- Size 350KB
- Sample240206-srwhysbgem
- SHA256 46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464
Malware Config
Extracted
-
agenttesla
-
https://discord.com/api/webhooks/1201267552622477446/eLGQ4lmofkh0zrpLn2k5CRdEZBWRzpA63gSbTgqw5jtBQxv7qbjyA3EZ5GJYz-KnwBl7
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe"C:\Users\Admin\AppData\Local\Temp\46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2520-14-0x0000000074840000-0x0000000074F2E000-memory.dmp
memory/2520-1-0x0000000074840000-0x0000000074F2E000-memory.dmp
memory/2520-2-0x0000000000330000-0x0000000000388000-memory.dmp
memory/2520-0-0x0000000000930000-0x000000000098C000-memory.dmp
memory/2520-4-0x0000000004B60000-0x0000000004BA0000-memory.dmp
memory/2520-5-0x0000000000430000-0x000000000043A000-memory.dmp
memory/2520-3-0x00000000003A0000-0x00000000003A6000-memory.dmp
memory/2652-13-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-8-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2652-7-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-16-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-11-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-9-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-6-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-17-0x0000000074150000-0x000000007483E000-memory.dmp
memory/2652-18-0x0000000004B70000-0x0000000004BB0000-memory.dmp
memory/2652-19-0x0000000074150000-0x000000007483E000-memory.dmp
memory/2652-20-0x0000000004B70000-0x0000000004BB0000-memory.dmp