Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
16/06/2024, 16:20
General
- Target PixelRecode.exe
- Size 2.0MB
- Sample240616-ttcdjazdnc
- SHA256 97d0f7e684d4ba895c0745908d730947e3ac627365793915cd39a421c5d0699d
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
- AgentTesla payload 1 IoCs
- Executes dropped EXE 6 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 5 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PixelRecode.exe"C:\Users\Admin\AppData\Local\Temp\PixelRecode.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\pixelrecode.exec:\users\admin\appdata\local\temp\pixelrecode.exe2⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
pixelrecode.exe
explorer.exe
icsys.icn.exe
svchost.exe
spoolsv.exe
memory/716-54-0x0000000000400000-0x000000000041F000-memory.dmp
memory/716-19-0x0000000000400000-0x000000000041F000-memory.dmp
memory/960-53-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1132-52-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1132-51-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3524-57-0x0000000074D7E000-0x0000000074D7F000-memory.dmp
memory/3524-14-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/3524-13-0x0000000005360000-0x0000000005572000-memory.dmp
memory/3524-12-0x0000000005170000-0x0000000005202000-memory.dmp
memory/3524-11-0x0000000005810000-0x0000000005DB4000-memory.dmp
memory/3524-15-0x0000000005680000-0x000000000568A000-memory.dmp
memory/3524-10-0x0000000000540000-0x0000000000720000-memory.dmp
memory/3524-9-0x0000000074D7E000-0x0000000074D7F000-memory.dmp
memory/3524-58-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/3524-56-0x0000000006960000-0x0000000006972000-memory.dmp
memory/4388-0-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4388-55-0x0000000000400000-0x000000000041F000-memory.dmp