Analysis
-
max time kernel
105s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
03/04/2025, 03:46
General
-
Target
Mv Star Suzanna-2.pdf.scr
-
Size
1.1MB
-
MD5
c522d9d33449816046f9edd5f714a9ab
-
SHA1
cdcae06501413499e97d3d3deb16e9e479be7e35
-
SHA256
a73a6ad6bba38d4ecb83ec7d4c3869afa3888597f362033dd50e9c4e0ca37835
-
SHA512
24a6045de5e7fb3ee978a554a0a2960c9479f0e2144ec97fbd9395d36f2e614279e40c56129aedce1df57be14ff3af433f29ccfe5186874b63fe28d10cb7bb81
-
SSDEEP
24576:wu6J33O0c+JY5UZ+XC0kGso6FajvsU0qI691fzMIZWY:6u0c++OCvkGs9FajEUU69RMlY
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mv Star Suzanna-2.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Mv Star Suzanna-2.pdf.scr" /S1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Mv Star Suzanna-2.pdf.scr" /S2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD558cc8b7f4f86758c788c624a95813d12
SHA109610a5b7899490e6b9b59aa2ec242214cb57bac
SHA2564305f71574b81d0e8b357b39f1fb2cbd6e742276951dae178b81b264bf1d9743
SHA512753c22b1d1f4c01264adb60275a01404ebb9a0a83e563739f72243f99eba83cffa6f6b3205c5c9dca54c2197bc57b9db770e902b82df64642e6329040e0f7629
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
328KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
4.0MB