Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 02:00

General

  • Target

    ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe

  • Size

    1.2MB

  • MD5

    a2a2e7e02d9543edcde82440d81595b1

  • SHA1

    2f7bc3c847c661606a1ef80456ed085f5bf50e46

  • SHA256

    ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6

  • SHA512

    7d769716bf0bda0f110e65f589d98170933f253a97ad52e7d3fdccd7899569e3c4ae0056a8b15abe22d1bc1856871326ea0a4a8590566dcecd587b59509c9161

  • SSDEEP

    24576:nAHnh+eWsN3skA4RV1Hom2KXMmHaFIhIDtRyBBNuTEnJBT7tRsxSs30AZ5:ah+ZkldoPK8YaFIhIDtYBNpnHnn23t

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 33 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe
    "C:\Users\Admin\AppData\Local\Temp\ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\derogates

    Filesize

    262KB

    MD5

    970fcfcb842b95ca2ac26c70c53fabed

    SHA1

    399c9dbecec7f0593d40f73fe4663faaf05c764c

    SHA256

    98d209ec0867f63f495501ce343b718934d910e372309308a4336186cd1e942b

    SHA512

    bce38f23cefc1859c25fafbea3400743a00655e41c6ebf7399c5dc3c9737cd105bce81d34df952fbfd3711d14188bf78b6d22278ba9e7db167074b5cf70690bd

  • memory/2916-63-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-1069-0x0000000074870000-0x0000000074F5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-15-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2916-14-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2916-16-0x000000007487E000-0x000000007487F000-memory.dmp

    Filesize

    4KB

  • memory/2916-17-0x0000000000340000-0x0000000000394000-memory.dmp

    Filesize

    336KB

  • memory/2916-18-0x0000000074870000-0x0000000074F5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-21-0x0000000074870000-0x0000000074F5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-20-0x0000000074870000-0x0000000074F5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-19-0x0000000000CD0000-0x0000000000D24000-memory.dmp

    Filesize

    336KB

  • memory/2916-25-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-35-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-81-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-79-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-77-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-75-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-61-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-71-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-69-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-67-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-65-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-1070-0x0000000074870000-0x0000000074F5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-57-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-12-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2916-73-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-55-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-53-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-51-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-49-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-47-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-45-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-43-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-41-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-39-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-37-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-33-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-31-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-29-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-27-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-23-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-22-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2916-1066-0x0000000074870000-0x0000000074F5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-1067-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2916-1068-0x000000007487E000-0x000000007487F000-memory.dmp

    Filesize

    4KB

  • memory/2916-59-0x0000000000CD0000-0x0000000000D1D000-memory.dmp

    Filesize

    308KB

  • memory/2984-11-0x00000000001A0000-0x00000000001A4000-memory.dmp

    Filesize

    16KB