Analysis
- max time kernel
150s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/06/2024, 09:26
General
- Target NaZonWare.exe
- Size 2.1MB
- Sample240609-ld8g2ahd67
- SHA256 f19ae8751b7a32b1de3c927af4035dcf1d3977f859a1ae97ad54cdf835d3f99b
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NaZonWare.exe"C:\Users\Admin\AppData\Local\Temp\NaZonWare.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6124-0-0x000000007486E000-0x000000007486F000-memory.dmp
memory/6124-1-0x0000000000E90000-0x00000000010BC000-memory.dmp
memory/6124-2-0x00000000060A0000-0x0000000006644000-memory.dmp
memory/6124-3-0x0000000005AF0000-0x0000000005B82000-memory.dmp
memory/6124-4-0x0000000074860000-0x0000000075010000-memory.dmp
memory/6124-5-0x0000000006D50000-0x0000000006D62000-memory.dmp
memory/6124-6-0x0000000006EA0000-0x0000000006EAA000-memory.dmp
memory/6124-7-0x0000000007080000-0x0000000007294000-memory.dmp
memory/6124-8-0x0000000009B70000-0x0000000009BD6000-memory.dmp
memory/6124-9-0x0000000074860000-0x0000000075010000-memory.dmp
memory/6124-11-0x0000000009FD0000-0x000000000A00C000-memory.dmp
memory/6124-13-0x000000007486E000-0x000000007486F000-memory.dmp
memory/6124-14-0x0000000074860000-0x0000000075010000-memory.dmp
memory/6124-15-0x0000000074860000-0x0000000075010000-memory.dmp