Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
25-04-2024 01:03
General
-
Target
0766dcf703dbf0243d873fff3b325054eee96ce58a9753ac8aa9891c311b4434.exe
-
Size
1.2MB
-
MD5
52e4f8ee79c595a890bc451dfbbbb9f4
-
SHA1
12b24cc207161c893d5c87fc12453c083275d11f
-
SHA256
0766dcf703dbf0243d873fff3b325054eee96ce58a9753ac8aa9891c311b4434
-
SHA512
b10bad66f74786fef8e514c807700127e5518f3b64f14c6f05585f65bf01da7e0ff38de338e88ff1d5698e7c7a4c6f60a3294066ce7ea0d7b8a2881a67e3fcea
-
SSDEEP
24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8alPCJcAwNhy:sTvC/MTQYxsWR7alPC6B
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
-
Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
-
Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
-
Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0766dcf703dbf0243d873fff3b325054eee96ce58a9753ac8aa9891c311b4434.exe"C:\Users\Admin\AppData\Local\Temp\0766dcf703dbf0243d873fff3b325054eee96ce58a9753ac8aa9891c311b4434.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\0766dcf703dbf0243d873fff3b325054eee96ce58a9753ac8aa9891c311b4434.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aut3141.tmpFilesize
262KB
MD5af93bac11a87df70b05710e2b7218060
SHA12a4a8a7ac508ff1981296b784b6042e5d7c150a0
SHA25633b56671717891b41069f8a8252e1aa46dcd99e681393f4be26235d85291df1c
SHA51227163075fc4e0d6b98b3188eda42e0d01e5acb0f1f53ee6742e0123c267007ad6829dda77a7517baaf5c5a9f27d90483d7866becf0ce5319e45824163844f4ba
-
memory/3760-12-0x00000000022E0000-0x00000000022E4000-memory.dmpFilesize
16KB
-
memory/4684-13-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4684-14-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4684-15-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4684-16-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4684-17-0x0000000005350000-0x00000000053A4000-memory.dmpFilesize
336KB
-
memory/4684-18-0x0000000074BE0000-0x0000000075390000-memory.dmpFilesize
7.7MB
-
memory/4684-19-0x0000000002CE0000-0x0000000002CF0000-memory.dmpFilesize
64KB
-
memory/4684-20-0x0000000002CE0000-0x0000000002CF0000-memory.dmpFilesize
64KB
-
memory/4684-21-0x0000000002CE0000-0x0000000002CF0000-memory.dmpFilesize
64KB
-
memory/4684-22-0x0000000005990000-0x0000000005F34000-memory.dmpFilesize
5.6MB
-
memory/4684-23-0x0000000005440000-0x0000000005492000-memory.dmpFilesize
328KB
-
memory/4684-24-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-25-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-27-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-29-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-33-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-31-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-35-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-37-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-41-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-43-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-39-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-45-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-47-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-51-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-49-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-53-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-55-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-57-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-59-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-61-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-65-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-63-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-67-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-69-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-71-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-75-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-77-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-79-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-83-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-81-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-73-0x0000000005440000-0x000000000548D000-memory.dmpFilesize
308KB
-
memory/4684-1056-0x0000000002CE0000-0x0000000002CF0000-memory.dmpFilesize
64KB
-
memory/4684-1057-0x0000000005640000-0x00000000056A6000-memory.dmpFilesize
408KB
-
memory/4684-1059-0x0000000006540000-0x0000000006590000-memory.dmpFilesize
320KB
-
memory/4684-1060-0x0000000006640000-0x00000000066D2000-memory.dmpFilesize
584KB
-
memory/4684-1061-0x00000000067F0000-0x00000000067FA000-memory.dmpFilesize
40KB
-
memory/4684-1062-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4684-1063-0x0000000074BE0000-0x0000000075390000-memory.dmpFilesize
7.7MB
-
memory/4684-1064-0x0000000002CE0000-0x0000000002CF0000-memory.dmpFilesize
64KB
-
memory/4684-1065-0x0000000002CE0000-0x0000000002CF0000-memory.dmpFilesize
64KB
-
memory/4684-1066-0x0000000002CE0000-0x0000000002CF0000-memory.dmpFilesize
64KB
-
memory/4684-1067-0x0000000002CE0000-0x0000000002CF0000-memory.dmpFilesize
64KB