agenttesla | 7156621a3971908023b30ff150f96f72e9cd757dd0be4b514721c0e688c845cb

General

Target

peak.exe
Size

3.7MB
MD5

eebe3fd6720cabdc477076f054829907
SHA1

f6056e84297b63c4cdaa5646697492d5705c9080
SHA256

7156621a3971908023b30ff150f96f72e9cd757dd0be4b514721c0e688c845cb
SHA512

00572e876baa9884e11875e3ef1e4d39a793c1165ffa5c98d8a753c1257f38791fda178483e0693826eff02cba7e8e0ae4b8a979bc505ab33ba763b002c72261
SSDEEP

98304:6wyZ0Cj88wMfPwozf3xdhdFUkGETCyukykgV8ja:699bftT3vhA4CyakgV8O

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2152-9-0x00000000054C0000-0x00000000056D2000-memory.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

peak.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions peak.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

peak.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools peak.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	peak.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	peak.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

peak.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	peak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	peak.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

13 discord.com
14 discord.com

flow	ioc
13	discord.com
14	discord.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

peak.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	peak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	peak.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

peak.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	peak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	peak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	peak.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

peak.exe

pid	process
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe
2152	peak.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

peak.exe

description pid process

Token: SeDebugPrivilege 2152 peak.exe

description	pid	process
Token: SeDebugPrivilege	2152	peak.exe

C:\Users\Admin\AppData\Local\Temp\peak.exe
"C:\Users\Admin\AppData\Local\Temp\peak.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

5

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x0000000075200000-0x00000000759B0000-memory.dmp

Filesize
7.7MB

Download
memory/2152-1-0x00000000003F0000-0x00000000007B6000-memory.dmp

Filesize
3.8MB

Download
memory/2152-2-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/2152-3-0x00000000063B0000-0x0000000006736000-memory.dmp

Filesize
3.5MB

Download
memory/2152-4-0x0000000006CF0000-0x0000000007294000-memory.dmp

Filesize
5.6MB

Download
memory/2152-5-0x0000000006740000-0x00000000067D2000-memory.dmp

Filesize
584KB

Download
memory/2152-6-0x00000000067E0000-0x0000000006846000-memory.dmp

Filesize
408KB

Download
memory/2152-8-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/2152-7-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/2152-9-0x00000000054C0000-0x00000000056D2000-memory.dmp

Filesize
2.1MB

Download
memory/2152-11-0x0000000007C20000-0x0000000007C3A000-memory.dmp

Filesize
104KB

Download
memory/2152-10-0x00000000079D0000-0x00000000079DA000-memory.dmp

Filesize
40KB

Download
memory/2152-12-0x0000000007D50000-0x0000000007E02000-memory.dmp

Filesize
712KB

Download
memory/2152-13-0x0000000007E80000-0x0000000007EA2000-memory.dmp

Filesize
136KB

Download
memory/2152-14-0x0000000009240000-0x0000000009594000-memory.dmp

Filesize
3.3MB

Download
memory/2152-15-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/2152-16-0x0000000075200000-0x00000000759B0000-memory.dmp

Filesize
7.7MB

Download
memory/2152-17-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/2152-18-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/2152-19-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads