Analysis
-
max time kernel
116s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 22:08
Static task
static1
Behavioral task
behavioral1
Sample
b7ab91889289babcced64e9acb2394a0N.exe
Resource
win7-20240903-en
General
-
Target
b7ab91889289babcced64e9acb2394a0N.exe
-
Size
4.8MB
-
MD5
b7ab91889289babcced64e9acb2394a0
-
SHA1
74e4096979036cc9bae821746966bcea0a666f2a
-
SHA256
2d209a6330260b7b7e55ccce687dd89f934efb3c892e4153eb74102d0faaced2
-
SHA512
dcdb58503b7bced0f025430cc010c51604216bf0867370111d4e3cbfacd95e0e87219649742fcea45f3ce475d91c34d438b2d9ee6d49ffcbfd4457699a70bb79
-
SSDEEP
98304:z9/9FHn51DY7VLm2/QvMMFJ7wbz9VtUl9rv:z9fHn6X/QBFUV8r
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/624-5-0x000001CA37370000-0x000001CA37584000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions b7ab91889289babcced64e9acb2394a0N.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools b7ab91889289babcced64e9acb2394a0N.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b7ab91889289babcced64e9acb2394a0N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b7ab91889289babcced64e9acb2394a0N.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b7ab91889289babcced64e9acb2394a0N.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 b7ab91889289babcced64e9acb2394a0N.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS b7ab91889289babcced64e9acb2394a0N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer b7ab91889289babcced64e9acb2394a0N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion b7ab91889289babcced64e9acb2394a0N.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe 624 b7ab91889289babcced64e9acb2394a0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 624 b7ab91889289babcced64e9acb2394a0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7ab91889289babcced64e9acb2394a0N.exe"C:\Users\Admin\AppData\Local\Temp\b7ab91889289babcced64e9acb2394a0N.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624