Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 06:14
General
-
Target
WIN CHANGER 2.3 (1).exe
-
Size
402.8MB
-
MD5
ac6f996ca7511978a0cb3595aa64ed64
-
SHA1
3d92d0feed1a705e520fe56762ae8c3aaf87e500
-
SHA256
8724dde766e041f9abefeba720eccd78f783545c4273681ba54c7133e0e809df
-
SHA512
b632ca45a3c30576d36b32374e6e4a6ce89fe7bb0d0a694ca8a5a3bb93d8d8c6a4f21738f39cfc4f0f02033e574f4018a9e5ba52ee575bf20758a74316f469ae
-
SSDEEP
6291456:BUVsZ8ANCCZtf0vsnlaje4V7U7w9g8DMbT1NOpMFJvWZT35eM/e0FdLR:B58ApZjn4BL9g4MF19R
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WIN CHANGER 2.3 (1).exe"C:\Users\Admin\AppData\Local\Temp\WIN CHANGER 2.3 (1).exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
16.0MB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
2.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
176KB
-
Filesize
680KB