Overview
overview
10Static
static
3VISUAL FRE...D).ttf
windows7-x64
3VISUAL FRE...D).ttf
windows10-2004-x64
7VISUAL FRE...D).ttf
windows7-x64
3VISUAL FRE...D).ttf
windows10-2004-x64
7VISUAL FRE...D).ttf
windows7-x64
3VISUAL FRE...D).ttf
windows10-2004-x64
7VISUAL FRE...SO.exe
windows7-x64
7VISUAL FRE...SO.exe
windows10-2004-x64
7VISUAL FRE...ST.exe
windows7-x64
7VISUAL FRE...ST.exe
windows10-2004-x64
7VISUAL FRE...ee.exe
windows7-x64
10VISUAL FRE...ee.exe
windows10-2004-x64
10Analysis
- max time kernel
148s - max time network
120s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
08/06/2024, 21:08
Static task
static1
Behavioral task
behavioral1
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/INSTALL ME (REQUIRED).ttf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/INSTALL ME (REQUIRED).ttf
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/INSTALL ME ASWELL! (REQUIRED).ttf
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/INSTALL ME ASWELL! (REQUIRED).ttf
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/INSTALL ME TO (REQUIRED).ttf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/INSTALL ME TO (REQUIRED).ttf
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/RUN ME ALSO.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral8
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/RUN ME ALSO.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/RUN ME FIRST.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
VISUAL FREE/VISUAL FREE/INSTALL THESE FIRST!/RUN ME FIRST.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
VISUAL FREE/VISUAL FREE/Visual Free.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
VISUAL FREE/VISUAL FREE/Visual Free.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target VISUAL FREE/VISUAL FREE/Visual Free.exe
- Size 1.5MB
- Sample240608-zy2f4sha75
- SHA256 4c467b19727b3a922e915c27431f15a0d39a33a9e7ab411d311ed521979385dd
- MD5 3a13abf4262c67c1b8cc4409f3c619ec
- SHA1 154a2c04005d0835317a3b525a3ad40dad7dc772
- SHA512 9edeb7584978f3c49719eeac93bf00ffefd9764261163d2031f5623839c5543537f40cc44c70c2611b715ac2ab6723b74bb4f1fb256ec33faaec8e5f88799263
- SSDEEP 24576:77o7X+gn2G9LJVJGnnA9FNQ3RGWZTCno8D+cM19s2XXCCLS/2ECRURusE6x:7Kr2aVJCAOGWZTkXMU2LaGRD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
resource yara_rule behavioral11/memory/2084-4-0x0000000005540000-0x0000000005754000-memory.dmp family_agenttesla - Delays execution with timeout.exe 1 IoCs
pid Process 2092 timeout.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Visual Free.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Visual Free.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Visual Free.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe 2084 Visual Free.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2084 Visual Free.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2804 2084 Visual Free.exe 28 PID 2084 wrote to memory of 2804 2084 Visual Free.exe 28 PID 2084 wrote to memory of 2804 2084 Visual Free.exe 28 PID 2084 wrote to memory of 2804 2084 Visual Free.exe 28 PID 2804 wrote to memory of 2092 2804 cmd.exe 30 PID 2804 wrote to memory of 2092 2804 cmd.exe 30 PID 2804 wrote to memory of 2092 2804 cmd.exe 30 PID 2804 wrote to memory of 2092 2804 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\VISUAL FREE\VISUAL FREE\Visual Free.exe"C:\Users\Admin\AppData\Local\Temp\VISUAL FREE\VISUAL FREE\Visual Free.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c >NUL timeout /t 2 && exit2⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\timeout.exetimeout /t 23⤵
- Delays execution with timeout.exe
PID:2092
-
-