Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
12/06/2024, 01:05
General
- Target a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
- Size 1.2MB
- Sample240612-bfvnvaxckp
- SHA256 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 7282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4652 -ip 46521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
aut373C.tmp
memory/836-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/836-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/836-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/836-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/836-17-0x000000007442E000-0x000000007442F000-memory.dmp
memory/836-18-0x0000000003080000-0x00000000030D4000-memory.dmp
memory/836-19-0x0000000005DD0000-0x0000000006374000-memory.dmp
memory/836-21-0x00000000056E0000-0x0000000005732000-memory.dmp
memory/836-20-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/836-22-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/836-74-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-50-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-82-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-80-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-78-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-76-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-72-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-70-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-68-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-66-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-64-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-62-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-60-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-58-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-56-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-54-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-52-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-48-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-46-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-44-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-42-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-40-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-38-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-34-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-32-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-30-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-28-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-36-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-26-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-24-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-23-0x00000000056E0000-0x000000000572D000-memory.dmp
memory/836-184-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/836-1054-0x0000000005920000-0x0000000005986000-memory.dmp
memory/836-1055-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/836-1056-0x00000000070D0000-0x0000000007120000-memory.dmp
memory/836-1057-0x00000000071C0000-0x0000000007252000-memory.dmp
memory/836-1058-0x0000000007130000-0x000000000713A000-memory.dmp
memory/836-1059-0x0000000000400000-0x0000000000446000-memory.dmp
memory/836-1060-0x000000007442E000-0x000000007442F000-memory.dmp
memory/836-1061-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/4652-12-0x0000000001CA0000-0x0000000001CA4000-memory.dmp