Analysis
- max time kernel
141s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
03/08/2024, 13:51
General
- Target LocalStealer.exe
- Size 4.3MB
- Sample240803-q52wsazdma
- SHA256 6c8cd2ff4020f57d558e878d87e8039ad3804614cad29957e279423af39b959d
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Obfuscated with Agile.Net obfuscator 8 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LocalStealer.exe"C:\Users\Admin\AppData\Local\Temp\LocalStealer.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4796-0-0x00007FF850B83000-0x00007FF850B85000-memory.dmp
memory/4796-1-0x000001FE54FA0000-0x000001FE553FA000-memory.dmp
memory/4796-3-0x000001FE57130000-0x000001FE57150000-memory.dmp
memory/4796-2-0x000001FE55800000-0x000001FE55820000-memory.dmp
memory/4796-5-0x000001FE6F920000-0x000001FE6F97A000-memory.dmp
memory/4796-6-0x000001FE57160000-0x000001FE57170000-memory.dmp
memory/4796-9-0x000001FE6FC90000-0x000001FE6FCFE000-memory.dmp
memory/4796-8-0x00007FF850B80000-0x00007FF851641000-memory.dmp
memory/4796-10-0x000001FE6F8C0000-0x000001FE6F8DE000-memory.dmp
memory/4796-7-0x000001FE6FA80000-0x000001FE6FC94000-memory.dmp
memory/4796-4-0x000001FE57150000-0x000001FE5715E000-memory.dmp
memory/4796-11-0x000001FE6FE00000-0x000001FE6FF4A000-memory.dmp
memory/4796-13-0x000001FE6F8E0000-0x000001FE6F910000-memory.dmp
memory/4796-12-0x000001FE6FF50000-0x000001FE70066000-memory.dmp
memory/4796-14-0x00007FF850B80000-0x00007FF851641000-memory.dmp
memory/4796-15-0x00007FF850B80000-0x00007FF851641000-memory.dmp
memory/4796-16-0x000001FE70070000-0x000001FE70219000-memory.dmp
memory/4796-17-0x00007FF850B83000-0x00007FF850B85000-memory.dmp
memory/4796-19-0x00007FF850B80000-0x00007FF851641000-memory.dmp
memory/4796-20-0x00007FF850B80000-0x00007FF851641000-memory.dmp
memory/4796-21-0x00007FF850B80000-0x00007FF851641000-memory.dmp