Analysis
-
max time kernel
147s -
max time network
114s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
04-09-2024 04:00
General
-
Target
Velocitylol.exe
-
Size
3.1MB
-
MD5
0c33284728a138decf9bf5229bc1272a
-
SHA1
41bac3740aee663620d82503e7dda4cd3f564eb7
-
SHA256
ad013bc1676f0fb7f9dd576d5d96e4b121770756abeb70379e01d0003dca8681
-
SHA512
0c9a0647418ffdf03ca31db1fbe7152a301953d1fe9a7115f18271c4690ed72af0e2b0acf9f6ad05234e6faa7cba759d815435cb67536a1253f1959a953a6622
-
SSDEEP
24576:cm+UY3EpCIJyWcl/Pe8FeyAK2p9KVQJ/nEBd8jjePIVCJDQHfsJpeLAb0BsqJEZj:NkY6l5vePmrlqqZZp/wuERzibxCfAz7
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Velocitylol.exe"C:\Users\Admin\AppData\Local\Temp\Velocitylol.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
7.7MB
-
Filesize
1.4MB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
2.1MB
-
Filesize
712KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB