Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
07-09-2024 16:01
General
-
Target
Enthapy.exe
-
Size
3.5MB
-
MD5
d71930c5e91a5e39b3645629b2ec11e9
-
SHA1
cb4d9d7dc4bddfedb85df5f3985786c88ea3dfb9
-
SHA256
c2bb9fa0dc16902993052818ec6267d78edda1fa3d484603fc66625da5666fd0
-
SHA512
5852b03559b1d4feaccb90d27904f209a1c92a819763d177fb88b67b8abd4cfbd59d3e80e2d5d560addde850710515e1fb01a41ed35db528e0c538efe5829fda
-
SSDEEP
98304:y1RvSndGBWsFcYQVArv4MnBpVgNhVRw+GI6:QRKdzUJQVArvb3gRRw+C
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Enthapy.exe"C:\Users\Admin\AppData\Local\Temp\Enthapy.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB