Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-01-2025 07:50
General
-
Target
68F921D55E5EBBC383106E2DE957DFD3A9DB76117D8BAEAF60D824954E4C3DD4.exe
-
Size
687KB
-
MD5
e78c1dbf5a60565752827b9da8be8f7c
-
SHA1
4a12a76c1156ba36a5ba6c71d861d9fb6d67b625
-
SHA256
68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4
-
SHA512
83e1c643808598d18ab70b46322c6809f4c08bbe2ad2459674bb5c0d48ecc42251ccda9b2b169be576299c2598633fdd8c07b54c4f7cfccb087be9c72af6ffca
-
SSDEEP
12288:MYV6MorX7qzuC3QHO9FQVHPF51jgcSpMQQpDkzgsp6YTzV+nvZSDaK4Tc0jNu:rBXu9HGaVHS2JDHY8vwaK4TNc
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68F921D55E5EBBC383106E2DE957DFD3A9DB76117D8BAEAF60D824954E4C3DD4.exe"C:\Users\Admin\AppData\Local\Temp\68F921D55E5EBBC383106E2DE957DFD3A9DB76117D8BAEAF60D824954E4C3DD4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\68F921D55E5EBBC383106E2DE957DFD3A9DB76117D8BAEAF60D824954E4C3DD4.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD54dbac371fb653107db7f5ecf33b5fd9c
SHA1db1c112d238f298f4e6129be8ea667666b92077f
SHA256637b7ff21bacc52eabac95e6a522216affacf05ac2b00e2697b492a3fbc30a68
SHA512f647ca9628cdfd6e6f4b4d643e8e1db48f719ba7e5687742e3d3dedcfb7ff931aa7e26f604090913897604f8af8d44a517f22dd2c00501f7839ab7707d3f3019
-
Filesize
1.5MB
-
Filesize
16KB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
280KB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
328KB
-
Filesize
6.9MB
-
Filesize
304KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
280KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
280KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
6.9MB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
6.9MB