Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
27-07-2024 23:24
General
-
Target
Loader.exe
-
Size
3.9MB
-
MD5
15ed52086cb6f7b5cb3fbec50b97b70d
-
SHA1
8eb6435bb2da4e9c1043b6700cd841fb7ec35014
-
SHA256
97b0558c630099adbb8a7b47c1b515e27312e02fe40471b1db5ad38e02035009
-
SHA512
16f7326e9759ee78f6b3af77ec843037624f660e5a6931a282ea76bc703412e501e19e43a58b4c71c2cc5978acd62af5b015822e12deffbf656f6f226da1f7d0
-
SSDEEP
49152:LIWNrW9dmqqlu0+E5lUn970wXmAY70nS4pfVkqgy6r3askqXfd+/9Aos:kJWqqluq5O97Z+7K5JEyUaskqXf0Ft
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.9MB
-
Filesize
10.8MB
-
Filesize
2.1MB
-
Filesize
10.8MB