Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 01:11
Static task
static1
Behavioral task
behavioral1
Sample
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe
Resource
win10v2004-20240226-en
General
-
Target
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe
-
Size
1.0MB
-
MD5
6193d97379d6bab368ab04f925d6c637
-
SHA1
67b60c01114207f76a61b8bbf29b578780458d1c
-
SHA256
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d
-
SHA512
ec42eb7197656b50b320e275f45790f375581293df1dbe56a514da42c00e662861bfa32a1d83e3a5b5beaf9987bb3b3ce25ce6afc237319bc4d3e1e451e974a9
-
SSDEEP
24576:dAHnh+eWsN3skA4RV1Hom2KXMmHa7PGZNQ5:8h+ZkldoPK8Ya7PGW
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.empowerfiresafe.com - Port:
587 - Username:
[email protected] - Password:
Jayapradha123@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exedescription pid process target process PID 4864 set thread context of 5104 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 5104 RegSvcs.exe 5104 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exepid process 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 5104 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exepid process 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exepid process 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exedescription pid process target process PID 4864 wrote to memory of 5104 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe RegSvcs.exe PID 4864 wrote to memory of 5104 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe RegSvcs.exe PID 4864 wrote to memory of 5104 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe RegSvcs.exe PID 4864 wrote to memory of 5104 4864 6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe"C:\Users\Admin\AppData\Local\Temp\6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\6576d8f3be4310d6e1c0ab8a9bf38a4fe30a37b573fc4927db556d2718c8051d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4864-10-0x0000000001DD0000-0x0000000001DD4000-memory.dmpFilesize
16KB
-
memory/5104-11-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/5104-13-0x0000000005CE0000-0x0000000006284000-memory.dmpFilesize
5.6MB
-
memory/5104-12-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/5104-14-0x00000000056B0000-0x0000000005716000-memory.dmpFilesize
408KB
-
memory/5104-15-0x0000000005890000-0x00000000058A0000-memory.dmpFilesize
64KB
-
memory/5104-16-0x00000000065E0000-0x0000000006630000-memory.dmpFilesize
320KB
-
memory/5104-17-0x00000000066D0000-0x0000000006762000-memory.dmpFilesize
584KB
-
memory/5104-18-0x0000000006640000-0x000000000664A000-memory.dmpFilesize
40KB
-
memory/5104-19-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/5104-20-0x0000000005890000-0x00000000058A0000-memory.dmpFilesize
64KB