Analysis
-
max time kernel
91s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 03:14
General
-
Target
catskidder.exe
-
Size
145.8MB
-
MD5
8df86e515a00ffd6e66595d722f91755
-
SHA1
b2f694bdc2db1974c48297fb1be7ff1786be2c7e
-
SHA256
09c6a649817b8e41d2ef4b787d783b06e77f985e74c5e1fcdb2449340721c4f6
-
SHA512
73c1424f64302d5be47534b8c9bdc5268d320701e912957a713664cc34b5778f431ea66aa341331b1ebd92ed9bfe1e7c0961731a42fc00bb1db257347abe90f3
-
SSDEEP
786432:jMBhE6u+mmzLWN3KPqiVmSYb3Tn3SjPoVEeFZXcNTtLwSTRpf4P1wT1Ubr6u:jV6u+XLTVmSwCroCYJbr6u
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\catskidder.exe"C:\Users\Admin\AppData\Local\Temp\catskidder.exe"1⤵
- Checks computer location settings
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.1MB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
12.7MB
-
Filesize
72KB
-
Filesize
1016KB
-
Filesize
256KB
-
Filesize
132KB
-
Filesize
76KB
-
Filesize
96KB
-
Filesize
128KB
-
Filesize
52KB
-
Filesize
772KB
-
Filesize
40KB
-
Filesize
28KB
-
Filesize
5.0MB
-
Filesize
724KB
-
Filesize
88KB
-
Filesize
20KB
-
Filesize
88KB
-
Filesize
116KB
-
Filesize
88KB
-
Filesize
168KB