Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe
Resource
win10v2004-20240412-en
General
-
Target
b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe
-
Size
330KB
-
MD5
f06c2933e107c821c0f1ce5189e00afe
-
SHA1
57178d398c17b35ab813606f3d663b79c273a8da
-
SHA256
b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff
-
SHA512
415f3b6fc8158ceef1808763418c70441460d714e0737a18c4578cf50c9fce3fa8e3f9a4a74f969191087c19d7b21603f5f35379e56271fdc011492181aa662b
-
SSDEEP
6144:KIimSUgVG/HLWUjVViBFGwkD5G8Sr36u2OT1/1RqPC8+IQFsy:pSdg/HLW40gNmBT1OC8+I
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.guestequipment.com.au - Port:
587 - Username:
[email protected] - Password:
Clone89! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2880 set thread context of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28 PID 2880 wrote to memory of 2948 2880 b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe"C:\Users\Admin\AppData\Local\Temp\b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe"C:\Users\Admin\AppData\Local\Temp\b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe"2⤵PID:2948
-