Analysis
-
max time kernel
25s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-09-2024 23:27
General
-
Target
SMT.exe
-
Size
1.4MB
-
MD5
10212120dfe7de1e0651ee89305a5497
-
SHA1
691a25c9179c16849934d9b62de214090c27ba80
-
SHA256
329757fc596770506ae85e94ec172215d52e5f80ccd962168a14819c7a71283b
-
SHA512
1a532b6e3985a873394587252e72da93bc4fd326ea3b0356d3e3d15a14004e0c1ab8d3946eb4d3229919f05b7e42166fa33b407185b83bde75835c4e2304d84d
-
SSDEEP
24576:X8a06ML8a06MrITMvRFhRRbNWoCfkYSEH3OqtwIuXKkqjVnlqud+/2P+A5Y:rcHcrITYbNbNWo4kSH3OqtwIjkqXfd++
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SMT.exe"C:\Users\Admin\AppData\Local\Temp\SMT.exe"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
5.6MB
-
Filesize
72KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
2.1MB
-
Filesize
712KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB