Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
15/06/2024, 01:41
General
- Target 4b53dba7aabbfca4a40e80e9b8b542ea42e4851f5f79e7d1269bda43ca1eccab.exe
- Size 1.2MB
- Sample240615-b4mcdavcna
- SHA256 4b53dba7aabbfca4a40e80e9b8b542ea42e4851f5f79e7d1269bda43ca1eccab
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b53dba7aabbfca4a40e80e9b8b542ea42e4851f5f79e7d1269bda43ca1eccab.exe"C:\Users\Admin\AppData\Local\Temp\4b53dba7aabbfca4a40e80e9b8b542ea42e4851f5f79e7d1269bda43ca1eccab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\4b53dba7aabbfca4a40e80e9b8b542ea42e4851f5f79e7d1269bda43ca1eccab.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
aut39CD.tmp
memory/2488-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2488-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2488-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2488-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2488-17-0x0000000074D8E000-0x0000000074D8F000-memory.dmp
memory/2488-18-0x0000000003010000-0x0000000003064000-memory.dmp
memory/2488-20-0x0000000005CA0000-0x0000000006244000-memory.dmp
memory/2488-19-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/2488-21-0x00000000056F0000-0x0000000005744000-memory.dmp
memory/2488-22-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/2488-23-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/2488-33-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-31-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-35-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-79-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-75-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-83-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-81-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-77-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-73-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-71-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-67-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-65-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-63-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-59-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-57-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-55-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-53-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-51-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-47-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-45-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-43-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-41-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-40-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-37-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-69-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-61-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-49-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-29-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-27-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-25-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-24-0x00000000056F0000-0x000000000573D000-memory.dmp
memory/2488-1076-0x00000000058B0000-0x0000000005916000-memory.dmp
memory/2488-1077-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/2488-1078-0x0000000006D30000-0x0000000006D80000-memory.dmp
memory/2488-1079-0x0000000006E20000-0x0000000006EB2000-memory.dmp
memory/2488-1080-0x0000000006E10000-0x0000000006E1A000-memory.dmp
memory/2488-1081-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2488-1082-0x0000000074D8E000-0x0000000074D8F000-memory.dmp
memory/2488-1083-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/4016-12-0x0000000001230000-0x0000000001234000-memory.dmp