Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
02/11/2024, 02:00
General
- Target 00aebe5b7380b6b35b6b07e34a23d2def055f32f989061d46ec9eb829743ff05.exe
- Size 1.5MB
- Sample241102-cfgmnayrfp
- SHA256 00aebe5b7380b6b35b6b07e34a23d2def055f32f989061d46ec9eb829743ff05
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 13 IoCs
- Suspicious use of SendNotifyMessage 13 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00aebe5b7380b6b35b6b07e34a23d2def055f32f989061d46ec9eb829743ff05.exe"C:\Users\Admin\AppData\Local\Temp\00aebe5b7380b6b35b6b07e34a23d2def055f32f989061d46ec9eb829743ff05.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\00aebe5b7380b6b35b6b07e34a23d2def055f32f989061d46ec9eb829743ff05.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1356-3-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1356-5-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1356-6-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1356-4-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1356-7-0x000000007431E000-0x000000007431F000-memory.dmp
memory/1356-8-0x0000000002BA0000-0x0000000002BF4000-memory.dmp
memory/1356-9-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/1356-10-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/1356-11-0x0000000005840000-0x0000000005DE4000-memory.dmp
memory/1356-12-0x00000000052D0000-0x0000000005322000-memory.dmp
memory/1356-16-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-14-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-13-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-30-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-70-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-68-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-66-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-64-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-62-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-60-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-58-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-56-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-54-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-50-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-48-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-46-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-44-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-42-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-40-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-38-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-34-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-32-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-28-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-26-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-24-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-22-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-20-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-18-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-72-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-52-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-36-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/1356-1045-0x00000000054A0000-0x0000000005506000-memory.dmp
memory/1356-1046-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/1356-1047-0x0000000006920000-0x0000000006970000-memory.dmp
memory/1356-1048-0x0000000006A10000-0x0000000006AA2000-memory.dmp
memory/1356-1049-0x0000000006980000-0x000000000698A000-memory.dmp
memory/1356-1050-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1356-1051-0x000000007431E000-0x000000007431F000-memory.dmp
memory/1356-1052-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/4564-2-0x0000000000DD0000-0x00000000011D0000-memory.dmp