Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04-06-2024 01:43

General

  • Target

    45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe

  • Size

    716KB

  • MD5

    64605be9d007ce3a0d7be5c2ac52b5bc

  • SHA1

    194b675d43243d9bc0826a6557018608e8fd1f39

  • SHA256

    45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4

  • SHA512

    b21fe3495cdcca49f19ffea6fbb72d2e3e168ae9feffaf47464b6221b51373bb188bdae05acad5165d94a8462b592c8f6d999db4e73e4dea9a39ea1ef9f0d19a

  • SSDEEP

    12288:zUQKt/rFfamKYqmdB9W1ZvuzxbWFBXOixQVHjJQ45vpSZ9qGdAJXAeYMxa/1mPfy:YQKN5imhqmP9KCoF9ED+gRS/wwh1F

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe
    "C:\Users\Admin\AppData\Local\Temp\45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2380-0-0x00000000748BE000-0x00000000748BF000-memory.dmp

    Filesize

    4KB

  • memory/2380-1-0x00000000003E0000-0x0000000000496000-memory.dmp

    Filesize

    728KB

  • memory/2380-2-0x00000000748B0000-0x0000000074F9E000-memory.dmp

    Filesize

    6.9MB

  • memory/2380-3-0x0000000000790000-0x00000000007A6000-memory.dmp

    Filesize

    88KB

  • memory/2380-4-0x0000000000830000-0x000000000083E000-memory.dmp

    Filesize

    56KB

  • memory/2380-5-0x0000000000840000-0x0000000000850000-memory.dmp

    Filesize

    64KB

  • memory/2380-6-0x0000000005010000-0x0000000005094000-memory.dmp

    Filesize

    528KB

  • memory/2380-7-0x00000000748BE000-0x00000000748BF000-memory.dmp

    Filesize

    4KB

  • memory/2380-8-0x00000000748B0000-0x0000000074F9E000-memory.dmp

    Filesize

    6.9MB

  • memory/2380-9-0x00000000005B0000-0x00000000005F2000-memory.dmp

    Filesize

    264KB