Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11-09-2024 13:33
General
-
Target
Utility1.0.5.3.exe
-
Size
80.3MB
-
MD5
9df116d463214ad42696da745600ee6e
-
SHA1
dbbf859398a34306251c3b484362daba4c553f9d
-
SHA256
42f87dcc7c95180584c1a4bc47741a9c916cffaf3acb66e1afcc77c82bbd7e05
-
SHA512
58f9458d4c38df4502603e6ec9a32696b0e0d6fdd907a54bf0db2fb8474843c01451ae4886cb3e129ae955220d13e4a6a959a17cc765f2cebe4d810338714827
-
SSDEEP
1572864:Z8XoJR784k9uzlSh5s2pGkBhKSUaWrlz/EKshAI2Ua59wVtXcTymTFYw9mK:eg84OuAL5KaWd/oAIcwVRIz
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Utility1.0.5.3.exe"C:\Users\Admin\AppData\Local\Temp\Utility1.0.5.3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86.0MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
86.0MB
-
Filesize
86.0MB
-
Filesize
1.4MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
2.0MB
-
Filesize
408KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
600KB
-
Filesize
1.3MB
-
Filesize
86.0MB
-
Filesize
960KB
-
Filesize
73.1MB
-
Filesize
960KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
960KB
-
Filesize
240KB
-
Filesize
960KB
-
Filesize
960KB