Analysis
- max time kernel
140s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 19:56
General
- Target AnyDesk (3).exe
- Size 16.2MB
- Sample240613-ynnltsshqm
- SHA256 8d376d0404e710f9a07b6ca662fa5ec2929f306dac00fa4222a173a345883bd7
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 39 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (3).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (3).exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3432-0-0x00007FF816413000-0x00007FF816415000-memory.dmp
memory/3432-1-0x000001F8D3A60000-0x000001F8D4A8E000-memory.dmp
memory/3432-2-0x000001F8EF410000-0x000001F8EF624000-memory.dmp
memory/3432-3-0x000001F8EF620000-0x000001F8EFA26000-memory.dmp
memory/3432-4-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-5-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-6-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-7-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-8-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-9-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-10-0x000001F8F08A0000-0x000001F8F0FF7000-memory.dmp
memory/3432-11-0x00007FF816413000-0x00007FF816415000-memory.dmp
memory/3432-12-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-13-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-15-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-16-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-17-0x00007FF816410000-0x00007FF816ED1000-memory.dmp
memory/3432-18-0x00007FF816410000-0x00007FF816ED1000-memory.dmp