Analysis
- max time kernel
118s - max time network
118s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
03/08/2024, 13:55
General
- Target LocalStealer.exe
- Size 4.3MB
- Sample240803-q8dncsvfmk
- SHA256 6c8cd2ff4020f57d558e878d87e8039ad3804614cad29957e279423af39b959d
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Obfuscated with Agile.Net obfuscator 8 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LocalStealer.exe"C:\Users\Admin\AppData\Local\Temp\LocalStealer.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/620-0-0x000007FEF5403000-0x000007FEF5404000-memory.dmp
memory/620-1-0x0000000000E90000-0x00000000012EA000-memory.dmp
memory/620-3-0x0000000000A60000-0x0000000000A80000-memory.dmp
memory/620-2-0x0000000000590000-0x00000000005B0000-memory.dmp
memory/620-4-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-6-0x0000000000B20000-0x0000000000B7A000-memory.dmp
memory/620-5-0x00000000005B0000-0x00000000005BE000-memory.dmp
memory/620-7-0x0000000000A80000-0x0000000000A90000-memory.dmp
memory/620-8-0x000000001B9F0000-0x000000001BC04000-memory.dmp
memory/620-9-0x000000001AF40000-0x000000001AFAE000-memory.dmp
memory/620-10-0x0000000000D20000-0x0000000000D3E000-memory.dmp
memory/620-11-0x000000001BE00000-0x000000001BF4A000-memory.dmp
memory/620-12-0x000000001B7D0000-0x000000001B8E6000-memory.dmp
memory/620-13-0x0000000000D40000-0x0000000000D70000-memory.dmp
memory/620-14-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-15-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-16-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-17-0x000007FEF5403000-0x000007FEF5404000-memory.dmp
memory/620-18-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-19-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-20-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-21-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-22-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/620-23-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp