Analysis
-
max time kernel
80s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:11
Static task
static1
Behavioral task
behavioral1
Sample
Account _Editor.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Account _Editor.exe
Resource
win10v2004-20240226-en
General
-
Target
Account _Editor.exe
-
Size
1.3MB
-
MD5
008ebc6333203e648958d4fd2382aee1
-
SHA1
3115d9a665073984de8b2dc4a963cc3e784a73bb
-
SHA256
88b3abbfca580a41a129719656faa22e308f492fb414ebef878533dc643757fc
-
SHA512
c60158987dfb18e53d6e53bce8c18689ba7e0fec7d9f7a74e335e36a8ff0e007c4acd481862882cd920496b0fd1b82e1ff692fd7c4629de21ef5fd30a64a3e15
-
SSDEEP
24576:9xDVAu0gy5oaV/lEVSL24t4rmbe3Bw5m9YvUkqjVnlqud+/2P+AJcdyFoBkkAne:9xDGu0gymI6kL14rmbCmU8UkqXfd+/9B
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4504-3-0x000001FEE0A00000-0x000001FEE0BF6000-memory.dmp family_agenttesla -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Account _Editor.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Account _Editor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Account _Editor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Account _Editor.exe -
Modifies registry class 20 IoCs
Processes:
Account _Editor.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Account _Editor.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Account _Editor.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Account _Editor.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Account _Editor.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Account _Editor.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Account _Editor.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Account _Editor.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Account _Editor.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Account _Editor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Account _Editor.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Account _Editor.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Account _Editor.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Account _Editor.exepid process 4504 Account _Editor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Account _Editor.exe"C:\Users\Admin\AppData\Local\Temp\Account _Editor.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4504-0-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmpFilesize
8KB
-
memory/4504-1-0x000001FEC6180000-0x000001FEC62D2000-memory.dmpFilesize
1.3MB
-
memory/4504-2-0x00007FF9872D0000-0x00007FF987D91000-memory.dmpFilesize
10.8MB
-
memory/4504-3-0x000001FEE0A00000-0x000001FEE0BF6000-memory.dmpFilesize
2.0MB
-
memory/4504-4-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmpFilesize
8KB
-
memory/4504-5-0x00007FF9872D0000-0x00007FF987D91000-memory.dmpFilesize
10.8MB