Analysis
-
max time kernel
446s -
max time network
448s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-04-2024 21:32
Behavioral task
behavioral1
Sample
Guna.UI2.dll
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
88 AntiVirus.exe
Resource
win11-20240426-en
General
-
Target
88 AntiVirus.exe
-
Size
451KB
-
MD5
a2e87a7c6ecd8ac0796667cc612bb61b
-
SHA1
d581ef5bc0518832b59115cd0a47b6f669ebd51c
-
SHA256
42134c7534f30a683ad5c1e1157367ced6360598a33e24b2343c2548b897c183
-
SHA512
a4c2000b5dc8eca851efedafee056487ced4210b06146d73aa50892a00e4e1c1e4185cb3037b0e3036be37bf5b48f30cb9c24fdcb30abcd1aeb140c5f5211982
-
SSDEEP
6144:hPkUwb08T2rqj7hT2rqj7hT2rqj7KMs7Xq0KELwb0:hPiSrqsrqsrqCMiXqB1
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4836-6-0x0000000005B10000-0x0000000005D24000-memory.dmp family_agenttesla -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
88 AntiVirus.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 88 AntiVirus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion 88 AntiVirus.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 88 AntiVirus.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
88 AntiVirus.exedescription pid process Token: SeDebugPrivilege 4836 88 AntiVirus.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
292KB
MD54d55409114bf655eda1ac1a13e83bbd5
SHA1f4744eb3e8c4eef218c192f0f270a23f68e51683
SHA256b6c228367130881f0d0f8a863be80cff735fe24a81d00e43c369025a865aa96c
SHA5128afa542c3e3f33bb70309d0cc122e87c25d0a51eae6f2498b8e8dcf40a4db00c56b6e91652fb5b582e20421f5a9e1b3bb71795b39a5694f8aa791fa8df61756a
-
memory/4836-0-0x0000000000380000-0x00000000003F6000-memory.dmpFilesize
472KB
-
memory/4836-1-0x0000000074CD0000-0x0000000075481000-memory.dmpFilesize
7.7MB
-
memory/4836-2-0x0000000005560000-0x0000000005B06000-memory.dmpFilesize
5.6MB
-
memory/4836-3-0x0000000004EB0000-0x0000000004F42000-memory.dmpFilesize
584KB
-
memory/4836-4-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/4836-5-0x0000000004EA0000-0x0000000004EAA000-memory.dmpFilesize
40KB
-
memory/4836-6-0x0000000005B10000-0x0000000005D24000-memory.dmpFilesize
2.1MB
-
memory/4836-7-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/4836-17-0x0000000074CD0000-0x0000000075481000-memory.dmpFilesize
7.7MB
-
memory/4836-18-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/4836-19-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB