Analysis

  • max time kernel
    120s
  • max time network
    103s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2024 10:20

General

  • Target

    c1d07bdf312e0899e77768a44d661e80N.exe

  • Size

    6.9MB

  • MD5

    c1d07bdf312e0899e77768a44d661e80

  • SHA1

    1a23d3fc0aec7049bff9b80f5ed7369ce38c4aa4

  • SHA256

    1c04efe27c8b4647064cbc02d915151cf39976c329f986f2094b4e7a7b92f396

  • SHA512

    3cab13493e09fc50af24481aa8d6bbdbb929ea2b8c037e95059dc840ff542e4516ad26fc8f79c2747c5840c02b60f935461806fdfb01165a14248ac85e7684c3

  • SSDEEP

    196608:QlP4wm68BQPc9cwom3ctpTP4+ljjNHjLjBHYqZkSI:QZ4wmRBQPc9Z3ctpHlvJ/B3kS

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1d07bdf312e0899e77768a44d661e80N.exe
    "C:\Users\Admin\AppData\Local\Temp\c1d07bdf312e0899e77768a44d661e80N.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2508-0-0x000007FEF4FC3000-0x000007FEF4FC4000-memory.dmp

    Filesize

    4KB

  • memory/2508-1-0x0000000000EE0000-0x00000000015C0000-memory.dmp

    Filesize

    6.9MB

  • memory/2508-2-0x000000001CBC0000-0x000000001CDD4000-memory.dmp

    Filesize

    2.1MB

  • memory/2508-3-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2508-4-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2508-5-0x0000000002CF0000-0x0000000002DA2000-memory.dmp

    Filesize

    712KB

  • memory/2508-6-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2508-8-0x000007FEF4FC3000-0x000007FEF4FC4000-memory.dmp

    Filesize

    4KB

  • memory/2508-9-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2508-10-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2508-11-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

    Filesize

    9.9MB