Analysis
- max time kernel
106s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/05/2024, 01:48
General
- Target f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe
- Size 664KB
- Sample240514-b8a5xaec8v
- SHA256 f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot6706700909:AAF84XSqJERRA6jKqejEqGMhCkiDguB_-5E/
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect ZGRat V1 33 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe"C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aut4FD5.tmp
memory/1208-57-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-1059-0x0000000074180000-0x0000000074930000-memory.dmp
memory/1208-18-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1208-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1208-1065-0x0000000074180000-0x0000000074930000-memory.dmp
memory/1208-20-0x000000007418E000-0x000000007418F000-memory.dmp
memory/1208-21-0x0000000005400000-0x0000000005454000-memory.dmp
memory/1208-22-0x0000000074180000-0x0000000074930000-memory.dmp
memory/1208-23-0x0000000074180000-0x0000000074930000-memory.dmp
memory/1208-24-0x0000000005AD0000-0x0000000006074000-memory.dmp
memory/1208-25-0x0000000005520000-0x0000000005572000-memory.dmp
memory/1208-65-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-56-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-83-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-81-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-79-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-77-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-75-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-73-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-71-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-69-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-67-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-63-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-62-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1208-59-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-85-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-53-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-51-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-49-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-47-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-45-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-43-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-41-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-39-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-37-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-35-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-33-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-31-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-29-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-27-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-26-0x0000000005520000-0x000000000556D000-memory.dmp
memory/1208-1058-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/1208-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1208-1060-0x0000000006B70000-0x0000000006BC0000-memory.dmp
memory/1208-1061-0x0000000006C60000-0x0000000006CF2000-memory.dmp
memory/1208-1062-0x0000000006C50000-0x0000000006C5A000-memory.dmp
memory/1208-1063-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1208-1064-0x000000007418E000-0x000000007418F000-memory.dmp
memory/1928-0-0x0000000000A30000-0x0000000000BAC000-memory.dmp
memory/1928-13-0x0000000004D60000-0x0000000004D64000-memory.dmp
memory/1928-19-0x0000000000A30000-0x0000000000BAC000-memory.dmp