Analysis
-
max time kernel
107s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 04:25
General
-
Target
CAPE MARS VSL'S PARTICULARS.docx.exe
-
Size
1.3MB
-
MD5
3fdd44d4178bb6c42cae954e1307ba0f
-
SHA1
db4aaf668c0ead4c1f93cea2e6ab732c87c81877
-
SHA256
db15aa19a87f7db96b971572182b09cb2b79ff78ac5fe747df663ce6288c3f98
-
SHA512
52ee2c01d8d9c954490c4d15662727c964dd145f29a06749cbd78ae414408631a9802200eaf1ae1fbc216be616de5211c8c95d895ec33f40bb05ea4e730a4690
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLxUARo1PNdukW8WvQCFn5rKX75uaKa:f3v+7/5QLxUTNdLW4CA75uA
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD5faf329af7b932d3f0f6340be098c774c
SHA1833706cb52719ad0b403ff14acf29e216607a84a
SHA256d805d575eef651bf3fc4c6ccccb782421cb97e659ce317ff4569f196cddd4a59
SHA5120def405de2261049842b044b3d520db00ff6eb91b9ca7205aa8958eabc1f94c8f0e680ec62d074e585de8a80740527e3d6c1f95cd848287c6157bbea1905fefc
-
Filesize
1.3MB
MD53fdd44d4178bb6c42cae954e1307ba0f
SHA1db4aaf668c0ead4c1f93cea2e6ab732c87c81877
SHA256db15aa19a87f7db96b971572182b09cb2b79ff78ac5fe747df663ce6288c3f98
SHA51252ee2c01d8d9c954490c4d15662727c964dd145f29a06749cbd78ae414408631a9802200eaf1ae1fbc216be616de5211c8c95d895ec33f40bb05ea4e730a4690
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
328KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
7.7MB