Overview

overview

10

Static

static

5

8e85642be9...73.exe

windows7-x64

10

8e85642be9...73.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 01:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe

  • Size

    1.2MB

  • MD5

    359d3e96ff4d7d9134950f306a2df9db

  • SHA1

    022d3dbd94f36564f5bfc9da8846c6db3cc3c096

  • SHA256

    8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073

  • SHA512

    c12c770b40f1287ec215a1a6955efe2f09bcbd53e57f061f85af9e8bf5b87f4fc113508dd3a3334f8e22bbc45a0bc2b02b5499cb6f44f633f0ffaaaec671e00e

  • SSDEEP

    24576:lAHnh+eWsN3skA4RV1Hom2KXMmHa8dIkziSlhSgQkY5:Uh+ZkldoPK8Ya8dIkPSd

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe
    "C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe"
      2⤵
        PID:1820
      • C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe
        "C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4480

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3540-10-0x0000000004120000-0x0000000004124000-memory.dmp

      Filesize

      16KB

      Download

    • memory/4480-23-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4480-25-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4480-24-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4480-26-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4480-27-0x000000007422E000-0x000000007422F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4480-28-0x00000000033E0000-0x0000000003434000-memory.dmp

      Filesize

      336KB

      Download

    • memory/4480-30-0x00000000060C0000-0x0000000006664000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4480-29-0x0000000074220000-0x00000000749D0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4480-31-0x00000000059C0000-0x0000000005A12000-memory.dmp

      Filesize

      328KB

      Download

    • memory/4480-32-0x0000000074220000-0x00000000749D0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4480-58-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-76-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-93-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-90-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-88-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-86-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-84-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-82-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-80-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-78-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-74-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-72-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-70-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-68-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-66-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-64-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-62-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-60-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-56-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-54-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-52-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-50-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-48-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-44-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-42-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-40-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-38-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-36-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-34-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-194-0x0000000074220000-0x00000000749D0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4480-46-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-33-0x00000000059C0000-0x0000000005A0D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4480-1064-0x0000000005C10000-0x0000000005C76000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4480-1065-0x0000000074220000-0x00000000749D0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4480-1066-0x0000000007050000-0x00000000070A0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/4480-1067-0x0000000007140000-0x00000000071D2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4480-1068-0x00000000070B0000-0x00000000070BA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4480-1069-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4480-1070-0x000000007422E000-0x000000007422F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4480-1071-0x0000000074220000-0x00000000749D0000-memory.dmp

      Filesize

      7.7MB

      Download