agenttesla | 33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d

General

Target

33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d.exe
Size

154.0MB
MD5

652219e3762bac4398d5d0d72d53dc9b
SHA1

c6e5a82be097208b154b2078b5b1fb1028c75ec2
SHA256

33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d
SHA512

748d104e30451122d1284445be19867b55656dc05bf666ec82e8d88f03c803690350cf5f696e0762822393e871d17dac5e4ad86e426ed36038af8964b7a62e8f
SSDEEP

1572864:UafzGToO0fw1GZrhqWKnUlqdoT43pv8Mx58REy0DZlecD:HfzdhbIoTY5jZAq

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3012-64-0x00000000074F0000-0x00000000079C0000-memory.dmp	family_agenttesla
behavioral1/memory/3012-67-0x00000000074F0000-0x00000000079C0000-memory.dmp	family_agenttesla

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d.exe

C:\Users\Admin\AppData\Local\Temp\33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d.exe
"C:\Users\Admin\AppData\Local\Temp\33579d62e29087f5f0948d5c209858ba6f811f809e39424d6776d6a2b8131e2d.exe"
1⤵
- Enumerates system info in registry
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000006680000-0x0000000007009000-memory.dmp

Filesize
9.5MB

Download
memory/3012-3-0x0000000006680000-0x0000000007009000-memory.dmp

Filesize
9.5MB

Download
memory/3012-5-0x0000000000220000-0x0000000000A48000-memory.dmp

Filesize
8.2MB

Download
memory/3012-4-0x0000000008190000-0x00000000092FF000-memory.dmp

Filesize
17.4MB

Download
memory/3012-8-0x0000000008190000-0x00000000092FF000-memory.dmp

Filesize
17.4MB

Download
memory/3012-9-0x0000000009300000-0x0000000009EE8000-memory.dmp

Filesize
11.9MB

Download
memory/3012-12-0x0000000009300000-0x0000000009EE8000-memory.dmp

Filesize
11.9MB

Download
memory/3012-13-0x00000000028F0000-0x0000000002901000-memory.dmp

Filesize
68KB

Download
memory/3012-16-0x00000000028F0000-0x0000000002901000-memory.dmp

Filesize
68KB

Download
memory/3012-17-0x0000000006260000-0x0000000006314000-memory.dmp

Filesize
720KB

Download
memory/3012-20-0x0000000006260000-0x0000000006314000-memory.dmp

Filesize
720KB

Download
memory/3012-21-0x0000000002970000-0x000000000297C000-memory.dmp

Filesize
48KB

Download
memory/3012-24-0x0000000002970000-0x000000000297C000-memory.dmp

Filesize
48KB

Download
memory/3012-25-0x0000000002950000-0x000000000296F000-memory.dmp

Filesize
124KB

Download
memory/3012-28-0x0000000002950000-0x000000000296F000-memory.dmp

Filesize
124KB

Download
memory/3012-29-0x0000000005B30000-0x0000000005B45000-memory.dmp

Filesize
84KB

Download
memory/3012-32-0x0000000005B30000-0x0000000005B45000-memory.dmp

Filesize
84KB

Download
memory/3012-33-0x0000000005D00000-0x0000000005D12000-memory.dmp

Filesize
72KB

Download
memory/3012-36-0x0000000005D00000-0x0000000005D12000-memory.dmp

Filesize
72KB

Download
memory/3012-40-0x0000000005CE0000-0x0000000005CFD000-memory.dmp

Filesize
116KB

Download
memory/3012-44-0x0000000005ED0000-0x0000000005F0A000-memory.dmp

Filesize
232KB

Download
memory/3012-47-0x0000000005ED0000-0x0000000005F0A000-memory.dmp

Filesize
232KB

Download
memory/3012-48-0x0000000006410000-0x00000000064F9000-memory.dmp

Filesize
932KB

Download
memory/3012-43-0x0000000005CE0000-0x0000000005CFD000-memory.dmp

Filesize
116KB

Download
memory/3012-51-0x0000000006410000-0x00000000064F9000-memory.dmp

Filesize
932KB

Download
memory/3012-55-0x0000000005D30000-0x0000000005D36000-memory.dmp

Filesize
24KB

Download
memory/3012-52-0x0000000005D30000-0x0000000005D36000-memory.dmp

Filesize
24KB

Download
memory/3012-59-0x0000000005D60000-0x0000000005D69000-memory.dmp

Filesize
36KB

Download
memory/3012-56-0x0000000005D60000-0x0000000005D69000-memory.dmp

Filesize
36KB

Download
memory/3012-60-0x0000000006320000-0x00000000063C5000-memory.dmp

Filesize
660KB

Download
memory/3012-63-0x0000000006320000-0x00000000063C5000-memory.dmp

Filesize
660KB

Download
memory/3012-64-0x00000000074F0000-0x00000000079C0000-memory.dmp

Filesize
4.8MB

Download
memory/3012-67-0x00000000074F0000-0x00000000079C0000-memory.dmp

Filesize
4.8MB

Download
memory/3012-112-0x0000000000220000-0x0000000000A48000-memory.dmp

Filesize
8.2MB

Download

Analysis

Sharing