Analysis
-
max time kernel
63s -
max time network
56s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-04-2024 11:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dist.exe
Resource
win11-20240419-en
windows11-21h2-x64
6 signatures
600 seconds
General
-
Target
Dist.exe
-
Size
3.6MB
-
MD5
f361f816f04927b3141122a57f2f3f82
-
SHA1
409cf10a30f668bcd1f6becdcc9089849b3d18ac
-
SHA256
0a13e3279eca443d8e25bcc1c7e1bc6701fc4ab4dade37a7a52995a09f33ff39
-
SHA512
f4aee7372d58f8099e6290375d92277a8e8c118941d9c3020bcaa88c8cac6df04b97832b5b412bffe27278e636aa53fd7e9315d473892aadf94a119377dbca02
-
SSDEEP
98304:Ok5IT4bNJFY3Oqt/h+KH4kpc+DX/0H4feb5CE:Ok5jBHYYKYODJebgE
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2316-3-0x0000027518B70000-0x0000027518D84000-memory.dmp family_agenttesla -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Dist.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Dist.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Dist.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Dist.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
Dist.exepid process 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe 2316 Dist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Dist.exedescription pid process Token: SeDebugPrivilege 2316 Dist.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Dist.exepid process 2316 Dist.exe 2316 Dist.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dist.exe"C:\Users\Admin\AppData\Local\Temp\Dist.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2316-1-0x00007FF8231D0000-0x00007FF823C92000-memory.dmpFilesize
10.8MB
-
memory/2316-0-0x000002757DFE0000-0x000002757E374000-memory.dmpFilesize
3.6MB
-
memory/2316-2-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-3-0x0000027518B70000-0x0000027518D84000-memory.dmpFilesize
2.1MB
-
memory/2316-4-0x0000027518D80000-0x0000027519186000-memory.dmpFilesize
4.0MB
-
memory/2316-6-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-5-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-7-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-8-0x0000027519B90000-0x0000027519C30000-memory.dmpFilesize
640KB
-
memory/2316-9-0x0000027519C30000-0x0000027519C56000-memory.dmpFilesize
152KB
-
memory/2316-10-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-11-0x0000027519D60000-0x0000027519D6A000-memory.dmpFilesize
40KB
-
memory/2316-12-0x000002757E790000-0x000002757E7AA000-memory.dmpFilesize
104KB
-
memory/2316-13-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-14-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-15-0x00007FF8231D0000-0x00007FF823C92000-memory.dmpFilesize
10.8MB
-
memory/2316-16-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-18-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-17-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-19-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-20-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-21-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-22-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-23-0x0000027500170000-0x0000027500180000-memory.dmpFilesize
64KB
-
memory/2316-24-0x000002751B7A0000-0x000002751B8A0000-memory.dmpFilesize
1024KB
-
memory/2316-25-0x000002751B7A0000-0x000002751B8A0000-memory.dmpFilesize
1024KB