Analysis
-
max time kernel
2356s -
max time network
2610s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 05:49
General
-
Target
Shipping documentsInvoice and Packing List.exe
-
Size
1.1MB
-
MD5
a78784673b95a0368e80d0f56481b2c9
-
SHA1
d6c57ae123c5b98fa5e74c705ab2f0ebef60d859
-
SHA256
d1597a1081547fc01a3cac3d22c31b5cd21ae2ad3b95c4b2a0fa75e9e77d204a
-
SHA512
98df4367be9a9027062373e6f999971cf5d47c65be0348e0caf8fcceacd69702ac59bff7e61c55ed082edeafb929b7671022c8444618dc8ae6dc9613ae11cc23
-
SSDEEP
24576:S4lavt0LkLL9IMixoEgea55qGbjauDaq9MmCS:Fkwkn9IMHea5L61aPCS
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7183646529:AAFkQSKmdVoaYTv19prcb1lxCwzZZaLys8o/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD5b3e8ad5bb2d6f05dba9e38094cc44f05
SHA1dc508fa1070fbc537dfc32bda0cddce6a4e9b540
SHA256bc96a7c9983b56f1e036fd2e88e488851048930436d8f08b4a1ae920ef6254ef
SHA512f638c1654cf91634cc5e41242d6c4d1b3f26a53dbfb47644920afab055579bfe03663eb9d83a42ef93817ffbfcc6ad315ca3134f992b9af9e63153681bc79b95
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
16KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
328KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
7.7MB