Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    23/04/2024, 05:37

General

  • Target

    RsKLvtCNnrkiaLu.exe

  • Size

    704KB

  • MD5

    a63c1e438213e8fe61cd6b4c6363211b

  • SHA1

    1d94ca869d19c155d024dc9880d2441dfef22f05

  • SHA256

    5da35ea88b86ff48676795109f73d0a0e1b3368ea68ec943d07612a8e8caaa26

  • SHA512

    aa45a06303df8e4257b08e4ae62a1be84376629c23bef2f81102f4e647147be0ba48965f6069fba70149411e8ce3f003a3320ac738852b30035bb157d8166dbc

  • SSDEEP

    12288:tXUvS1Z2ruliT2X/FvWoRDncMQocyyZViThGghSpyjJlXyVim3OR0FWCiQT:Sv/ClfFv3yD+hR6yjJlCVjLW/

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RsKLvtCNnrkiaLu.exe
    "C:\Users\Admin\AppData\Local\Temp\RsKLvtCNnrkiaLu.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2476-18-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2476-22-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2476-26-0x0000000004A00000-0x0000000004A40000-memory.dmp

    Filesize

    256KB

  • memory/2476-25-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2476-24-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2476-20-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2476-10-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2476-17-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2476-16-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2476-14-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2476-12-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2848-1-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2848-9-0x0000000004DF0000-0x0000000004E30000-memory.dmp

    Filesize

    256KB

  • memory/2848-8-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2848-7-0x0000000000390000-0x0000000000412000-memory.dmp

    Filesize

    520KB

  • memory/2848-0-0x00000000002D0000-0x0000000000386000-memory.dmp

    Filesize

    728KB

  • memory/2848-6-0x0000000000430000-0x0000000000444000-memory.dmp

    Filesize

    80KB

  • memory/2848-5-0x00000000002C0000-0x00000000002CE000-memory.dmp

    Filesize

    56KB

  • memory/2848-4-0x0000000000290000-0x00000000002A8000-memory.dmp

    Filesize

    96KB

  • memory/2848-23-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2848-3-0x0000000005110000-0x00000000051AE000-memory.dmp

    Filesize

    632KB

  • memory/2848-2-0x0000000004DF0000-0x0000000004E30000-memory.dmp

    Filesize

    256KB