Resubmissions

09-06-2024 19:19

240609-x1t4psea6y 10

Analysis

  • max time kernel
    18s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-06-2024 19:19

General

  • Target

    AimbotGratis.exe

  • Size

    2.9MB

  • MD5

    685961008fb7e400349d2f100ec06a77

  • SHA1

    5eb3eac4a70115c57f447bb0d105b0a8bf09f344

  • SHA256

    fb1f0d03a1030043806e23288230df0e22261ccc7bda7639d3cdf9b8bc7b15e5

  • SHA512

    e68c29697090dfb2f9c8d1930756cef9d7bce55c269a1eb40b2a371e0fb6f42650657ca131ff944bfe4b28369ae4472b8838e6f4736517e0b49d2f60b7fbdc16

  • SSDEEP

    49152:ciVsTUAiZjn4UAZatHTUAiZjn4UAZatnTUAiZjn4UAZatHTUAiZjn4UAZatrITYU:PCTBiZjn4UAIRTBiZjn4UAIJTBiZjn4C

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AimbotGratis.exe
    "C:\Users\Admin\AppData\Local\Temp\AimbotGratis.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1984-0-0x00007FFB82733000-0x00007FFB82735000-memory.dmp

    Filesize

    8KB

  • memory/1984-1-0x0000017D89890000-0x0000017D89B7E000-memory.dmp

    Filesize

    2.9MB

  • memory/1984-2-0x0000017D89F70000-0x0000017D89F82000-memory.dmp

    Filesize

    72KB

  • memory/1984-3-0x0000017DA4350000-0x0000017DA4564000-memory.dmp

    Filesize

    2.1MB

  • memory/1984-4-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

    Filesize

    10.8MB

  • memory/1984-5-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

    Filesize

    10.8MB

  • memory/1984-6-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

    Filesize

    10.8MB

  • memory/1984-7-0x0000017DA5070000-0x0000017DA50AC000-memory.dmp

    Filesize

    240KB

  • memory/1984-8-0x00007FFB82733000-0x00007FFB82735000-memory.dmp

    Filesize

    8KB

  • memory/1984-9-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

    Filesize

    10.8MB

  • memory/1984-10-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

    Filesize

    10.8MB