Resubmissions
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 22:43
Static task
static1
Behavioral task
behavioral1
Sample
Visual Perm.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Visual Perm.exe
Resource
win10v2004-20240508-en
General
-
Target
Visual Perm.exe
-
Size
5.2MB
-
MD5
e0bb46eb30fc7b79936b1f9bbb5061a6
-
SHA1
081cb5578e9bf30d64d8f49b1490095f3de55332
-
SHA256
fa43433ac5310fecd0f0f12bd26ff3c8b49f9545ede19b2efeb1d4946f3fa134
-
SHA512
da87dddd0a759fcd383af47923317db9175fa46f95a47d325405780efb493182912d0910e74430b54dbab2789f631809345f5d05d04616579b580ba1529b2f69
-
SSDEEP
98304:75D4elSDKkawSPTEyiatZOfDCfMsm2Ibp1Tn/O3oMv3odGB8cGpWbKLCn:B4gSGNvKDCfE2u/n/Km4kgbK
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/208-8-0x0000000005BD0000-0x0000000005DE4000-memory.dmp family_agenttesla -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Visual Perm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Visual Perm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Visual Perm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Visual Perm.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
Visual Perm.exepid process 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe 208 Visual Perm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Visual Perm.exedescription pid process Token: SeDebugPrivilege 208 Visual Perm.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/208-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmpFilesize
4KB
-
memory/208-1-0x00000000008B0000-0x0000000000DF4000-memory.dmpFilesize
5.3MB
-
memory/208-2-0x0000000074E40000-0x00000000755F0000-memory.dmpFilesize
7.7MB
-
memory/208-3-0x00000000069F0000-0x0000000006D80000-memory.dmpFilesize
3.6MB
-
memory/208-4-0x0000000007330000-0x00000000078D4000-memory.dmpFilesize
5.6MB
-
memory/208-5-0x0000000006E20000-0x0000000006EB2000-memory.dmpFilesize
584KB
-
memory/208-6-0x0000000006FF0000-0x0000000007002000-memory.dmpFilesize
72KB
-
memory/208-7-0x0000000005B10000-0x0000000005B1A000-memory.dmpFilesize
40KB
-
memory/208-8-0x0000000005BD0000-0x0000000005DE4000-memory.dmpFilesize
2.1MB
-
memory/208-9-0x00000000063D0000-0x000000000640C000-memory.dmpFilesize
240KB
-
memory/208-10-0x0000000074E40000-0x00000000755F0000-memory.dmpFilesize
7.7MB
-
memory/208-11-0x0000000074E4E000-0x0000000074E4F000-memory.dmpFilesize
4KB
-
memory/208-12-0x0000000074E40000-0x00000000755F0000-memory.dmpFilesize
7.7MB
-
memory/208-13-0x0000000074E40000-0x00000000755F0000-memory.dmpFilesize
7.7MB