Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 17:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
-x.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
-x.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
-x.exe
-
Size
2.7MB
-
MD5
6b5b5779dec66d876022b5ff3d82bf82
-
SHA1
9e47c838a7532674962b8ddb9e4074995a83c154
-
SHA256
b166a8ebdb437055e1fe7e5b81c525e3dd4b80f5949c1ddcb75c88f59173a4e2
-
SHA512
2fe290b40e9aeb0899feb91b189b4fc875d7c3f48a16ee8cb6419c2170a2465557bea26f6be639223506423fbf6c725e36bc59682e50b3acc69c9839abaa8301
-
SSDEEP
49152:+k3DYdh9pfoh9pf3ITYbNbNWo4kSH3OqtwIyBn783vSskcu:+k3DYdhEhLIT4bNJFY3OqteR8/Vkcu
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral1/memory/2936-2-0x000000001C820000-0x000000001CA34000-memory.dmp family_agenttesla -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS -x.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer -x.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion -x.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2936 -x.exe