Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
12/09/2024, 01:30
General
- Target 4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe
- Size 1.2MB
- Sample240912-bwxhdatgrk
- SHA256 4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
roundups
memory/2672-6-0x0000000000570000-0x0000000000574000-memory.dmp
memory/2816-7-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2816-9-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2816-10-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2816-11-0x00000000749CE000-0x00000000749CF000-memory.dmp
memory/2816-12-0x0000000000C40000-0x0000000000C94000-memory.dmp
memory/2816-13-0x00000000749C0000-0x00000000750AE000-memory.dmp
memory/2816-15-0x00000000749C0000-0x00000000750AE000-memory.dmp
memory/2816-14-0x00000000749C0000-0x00000000750AE000-memory.dmp
memory/2816-16-0x0000000000C90000-0x0000000000CE4000-memory.dmp
memory/2816-40-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-38-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-36-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-34-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-32-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-30-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-28-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-26-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-24-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-22-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-20-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-18-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-76-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-74-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-1055-0x00000000749C0000-0x00000000750AE000-memory.dmp
memory/2816-72-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-70-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-68-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-66-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-64-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-62-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-60-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-58-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-56-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-54-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-52-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-50-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-48-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-46-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-44-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-42-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-17-0x0000000000C90000-0x0000000000CDD000-memory.dmp
memory/2816-1056-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2816-1057-0x00000000749CE000-0x00000000749CF000-memory.dmp
memory/2816-1058-0x00000000749C0000-0x00000000750AE000-memory.dmp
memory/2816-1059-0x00000000749C0000-0x00000000750AE000-memory.dmp