Analysis
- max time kernel
107s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
21/11/2024, 09:47
General
- Target 66e68902e968ac5c762b7d4950df70b2ef8125d38d6884ff9e37e72542e47b68.exe
- Size 1.2MB
- Sample241121-lr74eszhpb
- SHA256 66e68902e968ac5c762b7d4950df70b2ef8125d38d6884ff9e37e72542e47b68
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66e68902e968ac5c762b7d4950df70b2ef8125d38d6884ff9e37e72542e47b68.exe"C:\Users\Admin\AppData\Local\Temp\66e68902e968ac5c762b7d4950df70b2ef8125d38d6884ff9e37e72542e47b68.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\66e68902e968ac5c762b7d4950df70b2ef8125d38d6884ff9e37e72542e47b68.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1720-2-0x00000000041F0000-0x00000000043F0000-memory.dmp
memory/4068-3-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4068-4-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4068-5-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4068-6-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4068-7-0x000000007397E000-0x000000007397F000-memory.dmp
memory/4068-8-0x0000000002D80000-0x0000000002DD6000-memory.dmp
memory/4068-10-0x0000000005B30000-0x00000000060D4000-memory.dmp
memory/4068-9-0x0000000073970000-0x0000000074120000-memory.dmp
memory/4068-11-0x0000000073970000-0x0000000074120000-memory.dmp
memory/4068-13-0x0000000073970000-0x0000000074120000-memory.dmp
memory/4068-12-0x00000000031A0000-0x00000000031F4000-memory.dmp
memory/4068-47-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-55-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-75-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-73-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-71-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-69-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-67-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-65-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-63-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-61-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-59-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-57-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-53-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-51-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-49-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-45-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-43-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-41-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-39-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-37-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-35-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-33-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-31-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-29-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-27-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-25-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-23-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-21-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-17-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-15-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-19-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-14-0x00000000031A0000-0x00000000031EF000-memory.dmp
memory/4068-1112-0x0000000073970000-0x0000000074120000-memory.dmp
memory/4068-1113-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/4068-1115-0x0000000006B20000-0x0000000006B70000-memory.dmp
memory/4068-1116-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4068-1117-0x000000007397E000-0x000000007397F000-memory.dmp
memory/4068-1118-0x0000000073970000-0x0000000074120000-memory.dmp
memory/4068-1119-0x00000000010E0000-0x0000000001172000-memory.dmp
memory/4068-1120-0x00000000010A0000-0x00000000010AA000-memory.dmp