Analysis
- max time kernel
93s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
14/06/2024, 02:05
General
- Target ebea929b444a0d2f9d2715d14b8c0efb1d3263143c06485cb001ee7aea0442d6.exe
- Size 1.1MB
- Sample240614-ch5ghavflq
- SHA256 ebea929b444a0d2f9d2715d14b8c0efb1d3263143c06485cb001ee7aea0442d6
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebea929b444a0d2f9d2715d14b8c0efb1d3263143c06485cb001ee7aea0442d6.exe"C:\Users\Admin\AppData\Local\Temp\ebea929b444a0d2f9d2715d14b8c0efb1d3263143c06485cb001ee7aea0442d6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\ebea929b444a0d2f9d2715d14b8c0efb1d3263143c06485cb001ee7aea0442d6.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1180-10-0x00000000011F0000-0x00000000011F4000-memory.dmp
memory/1716-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1716-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1716-12-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1716-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1716-15-0x00000000740AE000-0x00000000740AF000-memory.dmp
memory/1716-16-0x0000000005350000-0x00000000053A6000-memory.dmp
memory/1716-17-0x00000000740A0000-0x0000000074850000-memory.dmp
memory/1716-18-0x0000000005AD0000-0x0000000006074000-memory.dmp
memory/1716-21-0x00000000740A0000-0x0000000074850000-memory.dmp
memory/1716-20-0x00000000740A0000-0x0000000074850000-memory.dmp
memory/1716-19-0x0000000005450000-0x00000000054A4000-memory.dmp
memory/1716-81-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-79-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-77-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-75-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-73-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-71-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-69-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-67-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-65-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-63-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-61-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-59-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-57-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-55-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-53-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-51-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-49-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-47-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-45-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-43-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-1076-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/1716-41-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-39-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-37-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-35-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-33-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-31-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-29-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-27-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-25-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-23-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-22-0x0000000005450000-0x000000000549E000-memory.dmp
memory/1716-1077-0x00000000740A0000-0x0000000074850000-memory.dmp
memory/1716-1079-0x00000000065C0000-0x0000000006610000-memory.dmp
memory/1716-1080-0x00000000066B0000-0x0000000006742000-memory.dmp
memory/1716-1081-0x0000000006620000-0x000000000662A000-memory.dmp
memory/1716-1082-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1716-1083-0x00000000740AE000-0x00000000740AF000-memory.dmp
memory/1716-1084-0x00000000740A0000-0x0000000074850000-memory.dmp