Analysis

  • max time kernel
    357s
  • max time network
    358s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 16:17

General

  • Target

    reach.exe

  • Size

    4.1MB

  • MD5

    c8cbc57915836322fd79b73f5cdd0047

  • SHA1

    ab2c9a392af16dde09c032b05ad19ca7c2170434

  • SHA256

    91a7ca4f9b9361e8eb01f2c52eeb67a36233cb7ccd481214472ed9065f247c52

  • SHA512

    a72619e18e262aba281ba70edc97a038bbbcf7ef0530cf66b85432baba0f1da71edb3ccaf014775c8faea702edf86e28c3fa84ddb22f9a09c08c1b59220dd3ff

  • SSDEEP

    98304:MY/Hu/2WllEKvUVoLu98EoHqDhmt8jgRVVjlvvv0p:MYGuUEToq8DHf8jgRVVt0p

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\reach.exe
    "C:\Users\Admin\AppData\Local\Temp\reach.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2172-0-0x000007FEF5973000-0x000007FEF5974000-memory.dmp

    Filesize

    4KB

  • memory/2172-1-0x000000013F1E0000-0x000000013F5FC000-memory.dmp

    Filesize

    4.1MB

  • memory/2172-2-0x000000001BFB0000-0x000000001C3C8000-memory.dmp

    Filesize

    4.1MB

  • memory/2172-3-0x0000000000960000-0x0000000000972000-memory.dmp

    Filesize

    72KB

  • memory/2172-4-0x0000000000980000-0x000000000099A000-memory.dmp

    Filesize

    104KB

  • memory/2172-5-0x000000001D490000-0x000000001D6A4000-memory.dmp

    Filesize

    2.1MB

  • memory/2172-6-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

    Filesize

    9.9MB

  • memory/2172-7-0x000007FEF5973000-0x000007FEF5974000-memory.dmp

    Filesize

    4KB

  • memory/2172-8-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

    Filesize

    9.9MB

  • memory/2172-9-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

    Filesize

    9.9MB