Analysis
- max time kernel
125s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
17/06/2024, 17:14
General
- Target NEW ORDER.exe
- Size 1.2MB
- Sample240617-vsdqmsxale
- SHA256 81eb8aa9b2226312d76e1bf196178ffd3bf4fa20f02de820451d4f654179655c
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 7443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4948 -ip 49481⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Graff
autE484.tmp
memory/1044-12-0x0000000003C20000-0x0000000003C24000-memory.dmp
memory/3792-27-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3792-29-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3792-28-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3792-30-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3792-31-0x00000000736AE000-0x00000000736AF000-memory.dmp
memory/3792-32-0x0000000002B90000-0x0000000002BE6000-memory.dmp
memory/3792-35-0x0000000002D10000-0x0000000002D64000-memory.dmp
memory/3792-34-0x00000000057A0000-0x0000000005D44000-memory.dmp
memory/3792-33-0x00000000736A0000-0x0000000073E50000-memory.dmp
memory/3792-64-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-95-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-93-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-198-0x00000000736A0000-0x0000000073E50000-memory.dmp
memory/3792-91-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-89-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-83-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-81-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-79-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-77-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-75-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-73-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-71-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-67-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-65-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-61-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-58-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-55-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-54-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-51-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-49-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-47-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-45-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-43-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-41-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-39-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-37-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-36-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-87-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-85-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-69-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-59-0x0000000002D10000-0x0000000002D5E000-memory.dmp
memory/3792-1081-0x00000000736A0000-0x0000000073E50000-memory.dmp
memory/3792-1082-0x0000000005360000-0x00000000053C6000-memory.dmp
memory/3792-1083-0x0000000006850000-0x00000000068A0000-memory.dmp
memory/3792-1084-0x0000000006940000-0x00000000069D2000-memory.dmp
memory/3792-1085-0x00000000068D0000-0x00000000068DA000-memory.dmp
memory/3792-1086-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3792-1087-0x00000000736AE000-0x00000000736AF000-memory.dmp
memory/3792-1088-0x00000000736A0000-0x0000000073E50000-memory.dmp