Analysis
- max time kernel
125s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/06/2024, 09:23
General
- Target SecuriteInfo.com.Win32.Evo-gen.1540.18028.exe
- Size 4.9MB
- Sample240625-lcf2dsvalr
- SHA256 2b6c6b7a7b4ea5723a15a92ce376e7818f7ab58f4dc5944275932440bf4e2b09
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.1540.18028.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.1540.18028.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4396,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4464-0-0x000000007535E000-0x000000007535F000-memory.dmp
memory/4464-1-0x0000000000930000-0x0000000000E30000-memory.dmp
memory/4464-2-0x0000000075350000-0x0000000075B00000-memory.dmp
memory/4464-3-0x0000000007CB0000-0x00000000080EE000-memory.dmp
memory/4464-4-0x00000000086A0000-0x0000000008C44000-memory.dmp
memory/4464-5-0x0000000005940000-0x00000000059D2000-memory.dmp
memory/4464-6-0x00000000080F0000-0x00000000084F6000-memory.dmp
memory/4464-7-0x0000000005920000-0x000000000592A000-memory.dmp
memory/4464-8-0x0000000009C50000-0x0000000009E64000-memory.dmp
memory/4464-9-0x0000000075350000-0x0000000075B00000-memory.dmp
memory/4464-10-0x0000000075350000-0x0000000075B00000-memory.dmp
memory/4464-11-0x0000000006B50000-0x0000000006B62000-memory.dmp
memory/4464-12-0x0000000075350000-0x0000000075B00000-memory.dmp
memory/4464-13-0x00000000071F0000-0x000000000722C000-memory.dmp
memory/4464-14-0x000000007535E000-0x000000007535F000-memory.dmp
memory/4464-15-0x0000000075350000-0x0000000075B00000-memory.dmp
memory/4464-16-0x0000000075350000-0x0000000075B00000-memory.dmp