Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 03:45
Static task
static1
Behavioral task
behavioral1
Sample
Your file name without extension goes here.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Your file name without extension goes here.exe
Resource
win10v2004-20240508-en
General
-
Target
Your file name without extension goes here.exe
-
Size
1.4MB
-
MD5
9fbf1890e0236da00be34bab1b6979c9
-
SHA1
4d9f66bdc24dda4355870001a1e25494bb0e411c
-
SHA256
b7f8e5d5eb84ea1419064f1d85b0e6570f9fb2b9cbc5eb72b11e463a3d7e6314
-
SHA512
bf827a0c4019af1aa565a82f747872bd014159dcc73fd8d76b08051026ff997b41797279544b78b2e5434fb3cd3d72405188274bb145a57a293d7051f459796e
-
SSDEEP
24576:OUzKsG5DaqdRk6JSpu1Ho6tsPqXz+ULhOxJ/NDCB32mJ+sz+D8yKnSk6Y8anr/:fr01nz+Ucf/UB3PJ+sKgyKQrar/
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
terminal4.veeblehosting.com - Port:
587 - Username:
[email protected] - Password:
Ifeanyi1987@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2432 set thread context of 4612 2432 Your file name without extension goes here.exe 92 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4612 msbuild.exe 4612 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4612 msbuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2432 wrote to memory of 4612 2432 Your file name without extension goes here.exe 92 PID 2432 wrote to memory of 4612 2432 Your file name without extension goes here.exe 92 PID 2432 wrote to memory of 4612 2432 Your file name without extension goes here.exe 92 PID 2432 wrote to memory of 4612 2432 Your file name without extension goes here.exe 92 PID 2432 wrote to memory of 4612 2432 Your file name without extension goes here.exe 92 PID 2432 wrote to memory of 4612 2432 Your file name without extension goes here.exe 92 PID 2432 wrote to memory of 4612 2432 Your file name without extension goes here.exe 92 PID 2432 wrote to memory of 4612 2432 Your file name without extension goes here.exe 92 PID 2432 wrote to memory of 4372 2432 Your file name without extension goes here.exe 93 PID 2432 wrote to memory of 4372 2432 Your file name without extension goes here.exe 93 PID 2432 wrote to memory of 4372 2432 Your file name without extension goes here.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Your file name without extension goes here.exe"C:\Users\Admin\AppData\Local\Temp\Your file name without extension goes here.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵PID:4372
-