Analysis
-
max time kernel
27s -
max time network
18s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-03-2024 07:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
msedge.exe
Resource
win11-20240221-en
windows11-21h2-x64
5 signatures
150 seconds
General
-
Target
msedge.exe
-
Size
1.2MB
-
MD5
681eba38b74a4e49c60e2afa4645e22f
-
SHA1
1be30752210c8772da802708e531bec578a156f7
-
SHA256
db6599549e8cf96cafe6901d5303fd9c0d08865d72d9677870c151e93110fd92
-
SHA512
82658b0d84731da66b6d556186580730f94a85fe175e52b59590d22b65ea3ab3d57db9eae73c9f6ecd77923edc46137dd5b5036d7bce65a1c655e74f4fa3ae69
-
SSDEEP
24576:V/kyITMvRFhRRbNWoCfkYSEH3OqtwIuX5mIfw+Jwz/S/6g:V/kyITYbNbNWo4kSH3OqtwI+mmw+W7SC
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3632-4-0x00000289F0630000-0x00000289F0844000-memory.dmp family_agenttesla -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
msedge.exepid process 3632 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
msedge.exedescription pid process Token: SeDebugPrivilege 3632 msedge.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3632-0-0x00000289EDC70000-0x00000289EDDB2000-memory.dmpFilesize
1.3MB
-
memory/3632-1-0x00000289EE210000-0x00000289EE222000-memory.dmpFilesize
72KB
-
memory/3632-2-0x00007FFA40610000-0x00007FFA410D2000-memory.dmpFilesize
10.8MB
-
memory/3632-3-0x00000289EE1C0000-0x00000289EE1D0000-memory.dmpFilesize
64KB
-
memory/3632-4-0x00000289F0630000-0x00000289F0844000-memory.dmpFilesize
2.1MB
-
memory/3632-5-0x00000289F2ED0000-0x00000289F2F0C000-memory.dmpFilesize
240KB
-
memory/3632-6-0x00000289EE1C0000-0x00000289EE1D0000-memory.dmpFilesize
64KB
-
memory/3632-7-0x00000289EE1C0000-0x00000289EE1D0000-memory.dmpFilesize
64KB
-
memory/3632-8-0x00000289EE1C0000-0x00000289EE1D0000-memory.dmpFilesize
64KB
-
memory/3632-9-0x00007FFA40610000-0x00007FFA410D2000-memory.dmpFilesize
10.8MB
-
memory/3632-10-0x00000289F32B0000-0x00000289F32C2000-memory.dmpFilesize
72KB
-
memory/3632-11-0x00000289F32E0000-0x00000289F32FA000-memory.dmpFilesize
104KB
-
memory/3632-12-0x00000289EE1C0000-0x00000289EE1D0000-memory.dmpFilesize
64KB
-
memory/3632-13-0x00000289EE1C0000-0x00000289EE1D0000-memory.dmpFilesize
64KB
-
memory/3632-14-0x00000289EE1C0000-0x00000289EE1D0000-memory.dmpFilesize
64KB