Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 01:09
Behavioral task
behavioral1
Sample
Skelly V2.exe
Resource
win7-20240215-en
General
-
Target
Skelly V2.exe
-
Size
2.5MB
-
MD5
b1262cd5f134c61ba3b077f309a843b8
-
SHA1
edaa655070619975f80590ffbd1cfab0c74c678f
-
SHA256
1a8da34980844838bce5efb93589edfd9c1a0a3d7243534544938c236f656c1d
-
SHA512
9daf4325e148a52f586f4649f53b8b965f62d80f47c8fe69bab4d2f6f3324e2f3420b88972dc0c7714d8dfa844cea476024482a3fd7c9cb464e0969e45404219
-
SSDEEP
49152:V92xyXxkYR0RXagDvjWj+0gR8NIpYc7s6cLVSUrRvUkM1Ku6bOOQ:z2xy+YzgHI+0gi2Yc7vcLM5su6K7
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4808-9-0x0000000006D50000-0x0000000006F62000-memory.dmp family_agenttesla -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4808-1-0x0000000000AF0000-0x0000000000D72000-memory.dmp agile_net -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Skelly V2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Skelly V2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Skelly V2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Skelly V2.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
Skelly V2.exepid process 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe 4808 Skelly V2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Skelly V2.exedescription pid process Token: SeDebugPrivilege 4808 Skelly V2.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4808-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmpFilesize
4KB
-
memory/4808-1-0x0000000000AF0000-0x0000000000D72000-memory.dmpFilesize
2.5MB
-
memory/4808-2-0x00000000057A0000-0x000000000592E000-memory.dmpFilesize
1.6MB
-
memory/4808-3-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4808-4-0x0000000005EE0000-0x0000000006484000-memory.dmpFilesize
5.6MB
-
memory/4808-6-0x0000000005A70000-0x0000000005AD6000-memory.dmpFilesize
408KB
-
memory/4808-5-0x00000000059D0000-0x0000000005A62000-memory.dmpFilesize
584KB
-
memory/4808-7-0x0000000006B40000-0x0000000006B52000-memory.dmpFilesize
72KB
-
memory/4808-8-0x0000000006AB0000-0x0000000006ABA000-memory.dmpFilesize
40KB
-
memory/4808-9-0x0000000006D50000-0x0000000006F62000-memory.dmpFilesize
2.1MB
-
memory/4808-10-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4808-11-0x0000000007C80000-0x0000000007CBC000-memory.dmpFilesize
240KB
-
memory/4808-12-0x0000000074EAE000-0x0000000074EAF000-memory.dmpFilesize
4KB
-
memory/4808-13-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4808-14-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB