Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/05/2024, 01:23
General
- Target 0bf1110ef3290769bf40fcdc73b8df2b5cf509d1d90ebb4781f80b8a6ed1fe5c.exe
- Size 563KB
- Sample240521-br8d3sdf53
- SHA256 0bf1110ef3290769bf40fcdc73b8df2b5cf509d1d90ebb4781f80b8a6ed1fe5c
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot6391280536:AAESZ3NYNHmB2sa_7hA_g6U5Mw3cJR9yhiI/
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bf1110ef3290769bf40fcdc73b8df2b5cf509d1d90ebb4781f80b8a6ed1fe5c.exe"C:\Users\Admin\AppData\Local\Temp\0bf1110ef3290769bf40fcdc73b8df2b5cf509d1d90ebb4781f80b8a6ed1fe5c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2012-10-0x0000000075150000-0x0000000075900000-memory.dmp
memory/2012-17-0x0000000075150000-0x0000000075900000-memory.dmp
memory/2012-16-0x0000000006AB0000-0x0000000006ABA000-memory.dmp
memory/2012-15-0x0000000006B40000-0x0000000006BD2000-memory.dmp
memory/2012-14-0x0000000006A00000-0x0000000006A9C000-memory.dmp
memory/2012-13-0x0000000006910000-0x0000000006960000-memory.dmp
memory/2012-12-0x0000000075150000-0x0000000075900000-memory.dmp
memory/2012-7-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2012-11-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/2576-4-0x0000000075150000-0x0000000075900000-memory.dmp
memory/2576-9-0x0000000075150000-0x0000000075900000-memory.dmp
memory/2576-6-0x0000000004D10000-0x0000000004D6E000-memory.dmp
memory/2576-5-0x00000000053F0000-0x0000000005994000-memory.dmp
memory/2576-0-0x000000007515E000-0x000000007515F000-memory.dmp
memory/2576-2-0x00000000027A0000-0x00000000027A8000-memory.dmp
memory/2576-3-0x00000000027D0000-0x00000000027EA000-memory.dmp
memory/2576-1-0x00000000003B0000-0x0000000000442000-memory.dmp