Analysis

  • max time kernel
    102s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 19:54

General

  • Target

    SaturnxExternal.exe

  • Size

    7.6MB

  • MD5

    39b0f9e3674e8434d552abbf494f5d9f

  • SHA1

    e4d284205e6dc6febc6829980026a6ec08089d75

  • SHA256

    ce02a8c4fed7aefb3da421a2eaffd13fe92495d8701f8016b7cbe946d380b493

  • SHA512

    f27311b90d923dcf364ec6cb674273c681aae874675bb8948a74f69984da8844ec1eb1b31513221e224b370e644d05dff1e4678ba5a7a9065dc78aeca59541dd

  • SSDEEP

    98304:g68jFBO6Y86I/aK0itvOYvIKW8w4avoEeB0EYISxkLwBOIwz8:gxH6FkVzvIT8w4soRpYHxk0BRwz8

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SaturnxExternal.exe
    "C:\Users\Admin\AppData\Local\Temp\SaturnxExternal.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1716-0-0x00007FFB18043000-0x00007FFB18045000-memory.dmp

    Filesize

    8KB

  • memory/1716-1-0x000001AFB9DB0000-0x000001AFBA556000-memory.dmp

    Filesize

    7.6MB

  • memory/1716-2-0x00007FFB18040000-0x00007FFB18B01000-memory.dmp

    Filesize

    10.8MB

  • memory/1716-3-0x000001AFD4CB0000-0x000001AFD5086000-memory.dmp

    Filesize

    3.8MB

  • memory/1716-4-0x000001AFBC130000-0x000001AFBC142000-memory.dmp

    Filesize

    72KB

  • memory/1716-5-0x000001AFD5090000-0x000001AFD52A4000-memory.dmp

    Filesize

    2.1MB

  • memory/1716-6-0x00007FFB18040000-0x00007FFB18B01000-memory.dmp

    Filesize

    10.8MB

  • memory/1716-7-0x000001AFDA2A0000-0x000001AFDA352000-memory.dmp

    Filesize

    712KB

  • memory/1716-8-0x000001AFDA3A0000-0x000001AFDA3C2000-memory.dmp

    Filesize

    136KB

  • memory/1716-10-0x000001AFDA3D0000-0x000001AFDA40C000-memory.dmp

    Filesize

    240KB

  • memory/1716-11-0x00007FFB18043000-0x00007FFB18045000-memory.dmp

    Filesize

    8KB

  • memory/1716-12-0x00007FFB18040000-0x00007FFB18B01000-memory.dmp

    Filesize

    10.8MB

  • memory/1716-13-0x00007FFB18040000-0x00007FFB18B01000-memory.dmp

    Filesize

    10.8MB