Analysis

  • max time kernel
    95s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-09-2024 09:05

General

  • Target

    ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65.exe

  • Size

    1.0MB

  • MD5

    e1cadc74a723c43d1005431c4cc6667f

  • SHA1

    5b4570b6164028647ae49097ae4ffa75a579f042

  • SHA256

    ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65

  • SHA512

    cf7e993ec6e3887c5e734d32d738589a36d366de05bf1deeff34bfd421957fc1320cbcf81d8120e30384ce9b5fd93db825339aa1afca52890574bd9a2d051240

  • SSDEEP

    24576:cAHnh+eWsN3skA4RV1Hom2KXMmHaonRHvrgxp5:7h+ZkldoPK8YaonuZ

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65.exe
    "C:\Users\Admin\AppData\Local\Temp\ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2772-12-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2772-13-0x000000007511E000-0x000000007511F000-memory.dmp

    Filesize

    4KB

  • memory/2772-14-0x0000000005650000-0x0000000005BF4000-memory.dmp

    Filesize

    5.6MB

  • memory/2772-15-0x0000000005110000-0x0000000005176000-memory.dmp

    Filesize

    408KB

  • memory/2772-16-0x0000000075110000-0x00000000758C0000-memory.dmp

    Filesize

    7.7MB

  • memory/2772-18-0x0000000005F00000-0x0000000005F50000-memory.dmp

    Filesize

    320KB

  • memory/2772-19-0x0000000005FF0000-0x0000000006082000-memory.dmp

    Filesize

    584KB

  • memory/2772-20-0x0000000005F70000-0x0000000005F7A000-memory.dmp

    Filesize

    40KB

  • memory/2772-21-0x000000007511E000-0x000000007511F000-memory.dmp

    Filesize

    4KB

  • memory/2772-22-0x0000000075110000-0x00000000758C0000-memory.dmp

    Filesize

    7.7MB

  • memory/4928-11-0x00000000014C0000-0x00000000014C4000-memory.dmp

    Filesize

    16KB