Analysis
- max time kernel
143s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/06/2024, 01:29
General
- Target cbefa3877c7e7cc392797a0efd9f99d0a746bd641ac02ff540230f19b4d2b2d6.exe
- Size 1.1MB
- Sample240608-bwkhtafb5t
- SHA256 cbefa3877c7e7cc392797a0efd9f99d0a746bd641ac02ff540230f19b4d2b2d6
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbefa3877c7e7cc392797a0efd9f99d0a746bd641ac02ff540230f19b4d2b2d6.exe"C:\Users\Admin\AppData\Local\Temp\cbefa3877c7e7cc392797a0efd9f99d0a746bd641ac02ff540230f19b4d2b2d6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\cbefa3877c7e7cc392797a0efd9f99d0a746bd641ac02ff540230f19b4d2b2d6.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
autFAFA.tmp
memory/1212-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1212-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1212-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1212-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1212-17-0x00000000742FE000-0x00000000742FF000-memory.dmp
memory/1212-18-0x00000000030C0000-0x0000000003116000-memory.dmp
memory/1212-19-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/1212-20-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/1212-21-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/1212-22-0x0000000005F50000-0x00000000064F4000-memory.dmp
memory/1212-23-0x00000000032E0000-0x0000000003334000-memory.dmp
memory/1212-25-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-33-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-75-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-83-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-81-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-79-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-77-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-71-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-69-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-68-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-65-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-63-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-61-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-59-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-57-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-55-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-53-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-51-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-49-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-47-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-43-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-41-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-39-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-37-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-35-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-73-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-31-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-29-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-27-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-45-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-24-0x00000000032E0000-0x000000000332E000-memory.dmp
memory/1212-1079-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/1212-1078-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/1212-1081-0x00000000067A0000-0x00000000067F0000-memory.dmp
memory/1212-1082-0x0000000006890000-0x0000000006922000-memory.dmp
memory/1212-1083-0x0000000006760000-0x000000000676A000-memory.dmp
memory/1212-1084-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1212-1085-0x00000000742FE000-0x00000000742FF000-memory.dmp
memory/1212-1086-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4780-12-0x0000000001FB0000-0x0000000001FB4000-memory.dmp