Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-11-2024 02:15
Static task
static1
Behavioral task
behavioral1
Sample
1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe
Resource
win7-20240903-en
General
-
Target
1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe
-
Size
1.1MB
-
MD5
177433242c915815b6c13dc992a2e82b
-
SHA1
4ef6d9a9b024d0e43dbb797e90234e768299296c
-
SHA256
1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf
-
SHA512
bc0b3b8367ad592f652ba21d8e87899daebc5bdad3ebeddf72331d6ce5269e9df8a6bf81fb409b49325a4648d6f71b087a1f1a45292d63e3185e98fc90c19fc1
-
SSDEEP
24576:jtb20pkaCqT5TBWgNQ7aIdoXsVfcwhoyVKMQXH6A:gVg5tQ7aIachfhSH5
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exedescription pid Process procid_target PID 2400 set thread context of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exeRegSvcs.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid Process 2804 RegSvcs.exe 2804 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exepid Process 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid Process Token: SeDebugPrivilege 2804 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exedescription pid Process procid_target PID 2400 wrote to memory of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30 PID 2400 wrote to memory of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30 PID 2400 wrote to memory of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30 PID 2400 wrote to memory of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30 PID 2400 wrote to memory of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30 PID 2400 wrote to memory of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30 PID 2400 wrote to memory of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30 PID 2400 wrote to memory of 2804 2400 1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe"C:\Users\Admin\AppData\Local\Temp\1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD537c8359babb5211ca2026d38a5de9d08
SHA1286adc5945eb69075f150a2c01d7c0e36d328dac
SHA2565cad2ca441900ae49aaa98725d963993bec2389af749265bc804011d57aeb8fb
SHA5121521e3ff9845061b9b7076ee3a32ff1a0b900abcb17b1d2d3d8a798473c70cde0208255f566378dc2b88d606fe40a7c58ceb931cb81a068792779e44482605d6