Analysis
- max time kernel
125s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
08/06/2024, 03:46
General
- Target a4347c7e421419d06736591308e428ad.exe
- Size 7.0MB
- Sample240608-ebphtahe33
- SHA256 7e2eae248f8a9dbda73aba588e5cb4a241375d08074a315404299d3ba2eed3c6
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4347c7e421419d06736591308e428ad.exe"C:\Users\Admin\AppData\Local\Temp\a4347c7e421419d06736591308e428ad.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4360,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2848-0-0x00007FFCBBCD3000-0x00007FFCBBCD5000-memory.dmp
memory/2848-1-0x000001C3C8CA0000-0x000001C3C9036000-memory.dmp
memory/2848-2-0x000001C3E38B0000-0x000001C3E3AC4000-memory.dmp
memory/2848-3-0x00007FFCBBCD0000-0x00007FFCBC791000-memory.dmp
memory/2848-4-0x000001C3E3AC0000-0x000001C3E3EC6000-memory.dmp
memory/2848-5-0x00007FFCBBCD0000-0x00007FFCBC791000-memory.dmp
memory/2848-6-0x00007FFCBBCD0000-0x00007FFCBC791000-memory.dmp
memory/2848-7-0x00007FFCBBCD0000-0x00007FFCBC791000-memory.dmp