Analysis
-
max time kernel
173s -
max time network
198s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/03/2024, 18:13
General
-
Target
SaturnX_.exe
-
Size
5.1MB
-
MD5
aef91e877861a81d25307c08539d01d3
-
SHA1
edf78a6ed3df3374e4b34353d6cc99c6efe52dce
-
SHA256
507440d73d9ad447ea6e576176b8b05d6f8e0e2c044a4519580a33e60dade8ba
-
SHA512
4909486d752c340b3e998227787fc3623adcd914731712d1e18af9d0031f2b815a67086d589369ae76f4b333ddde4347d54594d8fa32ddd8bd476be78ac6491a
-
SSDEEP
98304:GhjwP4ImCWMAWe1hynRA7NRxzChXdhb4uP5ZDETVdGx5GYZV+N13:EMu9j31wRAHGDxsxEx3ZV2t
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SaturnX_.exe"C:\Users\Admin\AppData\Local\Temp\SaturnX_.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
344B
MD55dcbbd67cfb310dc838c9ef347e6440f
SHA1760b5bcbb9496be06afd4a5004bc99b1328113cc
SHA256b9e6ec345dd2c37d02a67ab6c5810ed26166add00f524aea058cd79e7494e1fe
SHA51295ba90fab8b1308bbc16a07ca48ca5c61447af6bc74e564dbe8c3a0d1cb581a4fa8031eb0396b805ff22d6a1875bd45fe8e8e58e757ed3ff64cbbaf7d3fdc1c2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
3B
MD50a47484cf8a49fd036e1acf41c7619f7
SHA1bcbf172338421f26297a2592698edf8cc84ecbef
SHA256db775d1df73f2886f1bc2efb3573dff3ea0ed075aa18974cbbc361d941bd8cd0
SHA512e4533e87fa73aa0006a9480f5447d8b5ecfa6fc377a3dfc60e1854cb499edf7ab48a94201b0baa76406fe12ae207ee94016ba1d53eff8a254acc6e97fe94eeb5
-
Filesize
84KB
MD50b0e63957367e620b8697c5341af35b9
SHA169361c2762b2d1cada80667cd55bc5082e60af86
SHA256bd9cdcfaa0edecdb89a204965d20f4a896c6650d4840e28736d9bd832390e1c5
SHA51207d0e52c863f52ecb3d12fab9e71c7a18d54cbedb47250bee7e4297ff72ed793c23a2735c48090c261fe4633d53d03e305c1338dfc881bb86874d1633ff6ecee
-
Filesize
92KB
-
Filesize
56KB
-
Filesize
512KB
-
Filesize
11.3MB
-
Filesize
6.9MB
-
Filesize
132KB
-
Filesize
256KB
-
Filesize
92KB
-
Filesize
44KB
-
Filesize
296KB
-
Filesize
1.4MB
-
Filesize
524KB
-
Filesize
11.3MB
-
Filesize
6.9MB
-
Filesize
40KB
-
Filesize
11.3MB
-
Filesize
104KB
-
Filesize
2.1MB
-
Filesize
512KB
-
Filesize
256KB
-
Filesize
816KB
-
Filesize
704KB
-
Filesize
36KB
-
Filesize
960KB
-
Filesize
296KB
-
Filesize
8KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
92KB
-
Filesize
40KB
-
Filesize
256KB