Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-02-2024 11:25

General

  • Target

    SecuriteInfo.com.Win32.MalwareX-gen.12374.8764.exe

  • Size

    3.1MB

  • MD5

    38efd309bef8f9d5e339b48fe5c71672

  • SHA1

    997e2fd2c0374cc5c151910e6639fe1833bb4403

  • SHA256

    8af02548debe64b5b38f97d8b066e193cb1dbbf605939ca71271164847b8de85

  • SHA512

    0cb298995b8096675397cfcc264afe2477f97ba57df3198b2dd84748811954c0beeb0e87451c261cbb8e59afc47e98cc558e63d03ef990ddf9044fde4d67ffda

  • SSDEEP

    49152:2+PsGH0UVM+0LJ/SRHwGckleJU/U5A50K2rpn3VQdxPYneabOIc0/S7jU0h2OGoc:RsGH0yKSfU5A50DRVF/S7w0DG5Wod

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.12374.8764.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.12374.8764.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\WLkdL\WLkdL.dll

    Filesize

    84KB

    MD5

    0b0e63957367e620b8697c5341af35b9

    SHA1

    69361c2762b2d1cada80667cd55bc5082e60af86

    SHA256

    bd9cdcfaa0edecdb89a204965d20f4a896c6650d4840e28736d9bd832390e1c5

    SHA512

    07d0e52c863f52ecb3d12fab9e71c7a18d54cbedb47250bee7e4297ff72ed793c23a2735c48090c261fe4633d53d03e305c1338dfc881bb86874d1633ff6ecee

  • memory/5024-13-0x0000000007960000-0x00000000079C6000-memory.dmp

    Filesize

    408KB

  • memory/5024-10-0x0000000005A00000-0x0000000005A10000-memory.dmp

    Filesize

    64KB

  • memory/5024-14-0x0000000008220000-0x000000000836E000-memory.dmp

    Filesize

    1.3MB

  • memory/5024-1-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/5024-15-0x0000000005E70000-0x0000000005E84000-memory.dmp

    Filesize

    80KB

  • memory/5024-11-0x0000000007660000-0x00000000078F4000-memory.dmp

    Filesize

    2.6MB

  • memory/5024-12-0x0000000005AD0000-0x0000000005AE2000-memory.dmp

    Filesize

    72KB

  • memory/5024-16-0x00000000083A0000-0x00000000083AA000-memory.dmp

    Filesize

    40KB

  • memory/5024-3-0x0000000005BA0000-0x0000000005C32000-memory.dmp

    Filesize

    584KB

  • memory/5024-2-0x00000000060B0000-0x0000000006654000-memory.dmp

    Filesize

    5.6MB

  • memory/5024-0-0x0000000000E20000-0x0000000001134000-memory.dmp

    Filesize

    3.1MB

  • memory/5024-17-0x0000000009790000-0x00000000099A4000-memory.dmp

    Filesize

    2.1MB

  • memory/5024-18-0x0000000005A00000-0x0000000005A10000-memory.dmp

    Filesize

    64KB

  • memory/5024-19-0x0000000005A00000-0x0000000005A10000-memory.dmp

    Filesize

    64KB

  • memory/5024-20-0x0000000005A00000-0x0000000005A10000-memory.dmp

    Filesize

    64KB

  • memory/5024-21-0x000000000D510000-0x000000000D54C000-memory.dmp

    Filesize

    240KB

  • memory/5024-23-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB