Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
07/06/2024, 13:59
General
- Target Eternal Spoofer.exe
- Size 2.5MB
- Sample240607-rapteahc4s
- SHA256 7294aca9df8ffcb7908a39ee7f0bedf09a483c3ecac7d39cccfde0eab5e1cd7a
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eternal Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Eternal Spoofer.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/852-0-0x000000007461E000-0x000000007461F000-memory.dmp
memory/852-1-0x00000000000C0000-0x0000000000352000-memory.dmp
memory/852-2-0x00000000053F0000-0x0000000005994000-memory.dmp
memory/852-3-0x0000000004D40000-0x0000000004DD2000-memory.dmp
memory/852-4-0x0000000004CF0000-0x0000000004D02000-memory.dmp
memory/852-5-0x0000000004F30000-0x0000000004F3A000-memory.dmp
memory/852-6-0x0000000074610000-0x0000000074DC0000-memory.dmp
memory/852-7-0x0000000005100000-0x000000000524E000-memory.dmp
memory/852-8-0x0000000005280000-0x0000000005294000-memory.dmp
memory/852-9-0x00000000059A0000-0x0000000005BB2000-memory.dmp
memory/852-10-0x0000000008170000-0x0000000008222000-memory.dmp
memory/852-11-0x0000000074610000-0x0000000074DC0000-memory.dmp
memory/852-12-0x0000000006530000-0x0000000006552000-memory.dmp
memory/852-13-0x0000000008B20000-0x0000000008E74000-memory.dmp
memory/852-15-0x00000000065D0000-0x000000000660C000-memory.dmp
memory/852-17-0x000000007461E000-0x000000007461F000-memory.dmp
memory/852-18-0x0000000074610000-0x0000000074DC0000-memory.dmp
memory/852-19-0x0000000074610000-0x0000000074DC0000-memory.dmp