Analysis
-
max time kernel
50s -
max time network
55s -
platform
windows11-21h2_x64 -
resource
win11-20240319-en -
resource tags
arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-03-2024 07:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
msedge.exe
Resource
win11-20240319-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
msedge.exe
-
Size
1.2MB
-
MD5
681eba38b74a4e49c60e2afa4645e22f
-
SHA1
1be30752210c8772da802708e531bec578a156f7
-
SHA256
db6599549e8cf96cafe6901d5303fd9c0d08865d72d9677870c151e93110fd92
-
SHA512
82658b0d84731da66b6d556186580730f94a85fe175e52b59590d22b65ea3ab3d57db9eae73c9f6ecd77923edc46137dd5b5036d7bce65a1c655e74f4fa3ae69
-
SSDEEP
24576:V/kyITMvRFhRRbNWoCfkYSEH3OqtwIuX5mIfw+Jwz/S/6g:V/kyITYbNbNWo4kSH3OqtwI+mmw+W7SC
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1584-4-0x000002223B9B0000-0x000002223BBC4000-memory.dmp family_agenttesla -
Downloads MZ/PE file
-
Drops file in System32 directory 1 IoCs
Processes:
msedge.exedescription ioc process File created C:\Windows\System32\DRIFTIX_COLOR.dll msedge.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion msedge.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
msedge.exepid process 1584 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
msedge.exedescription pid process Token: SeDebugPrivilege 1584 msedge.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1584-0-0x0000022221160000-0x00000222212A2000-memory.dmpFilesize
1.3MB
-
memory/1584-1-0x00000222216F0000-0x0000022221702000-memory.dmpFilesize
72KB
-
memory/1584-2-0x00007FF8E40A0000-0x00007FF8E4B62000-memory.dmpFilesize
10.8MB
-
memory/1584-3-0x000002223B910000-0x000002223B920000-memory.dmpFilesize
64KB
-
memory/1584-4-0x000002223B9B0000-0x000002223BBC4000-memory.dmpFilesize
2.1MB
-
memory/1584-5-0x00007FF8E40A0000-0x00007FF8E4B62000-memory.dmpFilesize
10.8MB
-
memory/1584-6-0x000002223E400000-0x000002223E43C000-memory.dmpFilesize
240KB
-
memory/1584-7-0x000002223B910000-0x000002223B920000-memory.dmpFilesize
64KB
-
memory/1584-8-0x000002223B910000-0x000002223B920000-memory.dmpFilesize
64KB
-
memory/1584-9-0x000002223B910000-0x000002223B920000-memory.dmpFilesize
64KB
-
memory/1584-10-0x0000022221840000-0x0000022221852000-memory.dmpFilesize
72KB
-
memory/1584-11-0x000002223E7C0000-0x000002223E7DA000-memory.dmpFilesize
104KB
-
memory/1584-12-0x000002223B910000-0x000002223B920000-memory.dmpFilesize
64KB
-
memory/1584-14-0x000002223B910000-0x000002223B920000-memory.dmpFilesize
64KB