Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 05:58

General

  • Target

    DA14680-01F08A92 24K.exe

  • Size

    893KB

  • MD5

    ed567007d635c168315c462b2366b9ce

  • SHA1

    4e95b7774838bb0521b4ff4bd149dc1b27f5c50e

  • SHA256

    216176b4ebbcf066ad142fb327e53c7765e60261ef13d4ec45bb02d0db117082

  • SHA512

    b8d580f3b5fc73f6d6eb5fa6b75a1eba2ca1ed020d731cd7d116c582681efe56d5ba0f79dade933dcb73cdecf9440b9f788933a571d1d2280478ccd9d52608d5

  • SSDEEP

    12288:ylYifTU6KiRpwR5vP7EgYsK4clfXVmSSO3ItJnsY3Haahj6EMJbOpDZzlwMSYvMy:Fi3KoGbEgxch4ptP3H9hj67ADz2c

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\DA14680-01F08A92 24K.exe
    "C:\Users\Admin\AppData\Local\Temp\DA14680-01F08A92 24K.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3040-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

    Filesize

    4KB

  • memory/3040-1-0x0000000000FE0000-0x00000000010C2000-memory.dmp

    Filesize

    904KB

  • memory/3040-2-0x0000000074BF0000-0x00000000752DE000-memory.dmp

    Filesize

    6.9MB

  • memory/3040-3-0x0000000000390000-0x00000000003AA000-memory.dmp

    Filesize

    104KB

  • memory/3040-4-0x0000000000350000-0x0000000000360000-memory.dmp

    Filesize

    64KB

  • memory/3040-5-0x0000000005420000-0x00000000054D8000-memory.dmp

    Filesize

    736KB

  • memory/3040-6-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

    Filesize

    4KB

  • memory/3040-7-0x0000000074BF0000-0x00000000752DE000-memory.dmp

    Filesize

    6.9MB

  • memory/3040-8-0x00000000054E0000-0x0000000005556000-memory.dmp

    Filesize

    472KB