General
-
Target
DRAFT BL & MBL PO NO ECM1D2403-29.xls
-
Size
1.1MB
-
Sample
241112-hea2dawlgw
-
MD5
9d92634ba9c56395b993a433abadec4f
-
SHA1
016c81b545343fc20609bf76c1588a358336deea
-
SHA256
0980c818b185071ebf00005388e6d09283692a33cdd5a28005b76c0018960f40
-
SHA512
93f9f07d6e7d06c54e88d4c5aa9e53138e2d62ea522b35e08d94f075ed3e9cbde7b163dd79b897811a2677d5b3a804d9a55fd2bbeca2c4b74b7df3ba18a7c7a0
-
SSDEEP
24576:8q9PLiijE2Z5Z2am8gshXCdQtF84LJQodsKVXyiTsMEWyByK:8EPLiij7Z5ZK8gsAsFjLJQodH5TGWyB
Static task
static1
Behavioral task
behavioral1
Sample
DRAFT BL & MBL PO NO ECM1D2403-29.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
DRAFT BL & MBL PO NO ECM1D2403-29.xls
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
DRAFT BL & MBL PO NO ECM1D2403-29.xls
-
Size
1.1MB
-
MD5
9d92634ba9c56395b993a433abadec4f
-
SHA1
016c81b545343fc20609bf76c1588a358336deea
-
SHA256
0980c818b185071ebf00005388e6d09283692a33cdd5a28005b76c0018960f40
-
SHA512
93f9f07d6e7d06c54e88d4c5aa9e53138e2d62ea522b35e08d94f075ed3e9cbde7b163dd79b897811a2677d5b3a804d9a55fd2bbeca2c4b74b7df3ba18a7c7a0
-
SSDEEP
24576:8q9PLiijE2Z5Z2am8gshXCdQtF84LJQodsKVXyiTsMEWyByK:8EPLiij7Z5ZK8gsAsFjLJQodH5TGWyB
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Evasion via Device Credential Deployment
-
Executes dropped EXE
-
Loads dropped DLL
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-