Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 15:11
General
- Target MB263350411AE.exe
- Size 1.1MB
- Sample240603-sklp6sbf73
- SHA256 af9aa22b8ab619d43885d9a8e45d4b3bc0abf031d6c4a0e55ba24e52dbd7440b
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 7083⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3676 -ip 36761⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
aut49F9.tmp
spiketop
memory/548-12-0x0000000001E10000-0x0000000001E14000-memory.dmp
memory/2656-29-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2656-28-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2656-30-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2656-27-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2656-31-0x0000000073BDE000-0x0000000073BDF000-memory.dmp
memory/2656-32-0x0000000002CC0000-0x0000000002D14000-memory.dmp
memory/2656-34-0x00000000058A0000-0x0000000005E44000-memory.dmp
memory/2656-33-0x0000000073BD0000-0x0000000074380000-memory.dmp
memory/2656-35-0x00000000051D0000-0x0000000005222000-memory.dmp
memory/2656-36-0x0000000073BD0000-0x0000000074380000-memory.dmp
memory/2656-94-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-96-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-182-0x0000000073BD0000-0x0000000074380000-memory.dmp
memory/2656-92-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-90-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-88-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-86-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-84-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-82-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-80-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-78-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-74-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-72-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-70-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-68-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-66-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-64-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-62-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-60-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-58-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-56-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-54-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-52-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-50-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-48-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-46-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-44-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-42-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-40-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-38-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-37-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-76-0x00000000051D0000-0x000000000521D000-memory.dmp
memory/2656-1068-0x0000000073BD0000-0x0000000074380000-memory.dmp
memory/2656-1069-0x00000000053F0000-0x0000000005456000-memory.dmp
memory/2656-1070-0x0000000006840000-0x0000000006890000-memory.dmp
memory/2656-1071-0x0000000006930000-0x00000000069C2000-memory.dmp
memory/2656-1072-0x00000000068A0000-0x00000000068AA000-memory.dmp
memory/2656-1073-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2656-1074-0x0000000073BDE000-0x0000000073BDF000-memory.dmp
memory/2656-1075-0x0000000073BD0000-0x0000000074380000-memory.dmp