agenttesla | 72c8c3dd1f471377a5e1f7bd7fc0345b7c90a2b4f2b95b31532161c269dcc0fd

General

Target

peak.exe
Size

8.1MB
MD5

6216754d616e11771cc50fff0191e270
SHA1

7d9d187690845a8bbc9a300fdc6e7a51d411b08b
SHA256

72c8c3dd1f471377a5e1f7bd7fc0345b7c90a2b4f2b95b31532161c269dcc0fd
SHA512

471fb4068fa6fdd20e1dc88a24bb9c22cf12d5422dbecc29b174070af0be6f5195800ad597e398ffe179604a4aa2518f0ec27bd2cf7dc8a395ef00dcd3a6c803
SSDEEP

196608:jTQs1gi/7DMLibCjMAhT7oarL1VnnvbWFTbPfiXr:jT+i/7DM+byHwSZTC/X

Score

10^/10

agenttesla bootkit evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2864-25-0x00000000063C0000-0x00000000065D2000-memory.dmp	family_agenttesla

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

peak.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ peak.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	peak.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

peak.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	peak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	peak.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

peak.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA peak.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 discord.com
5 discord.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

peak.exe

description ioc process

File opened for modification \??\PhysicalDrive0 peak.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

peak.exe

pid process

2864 peak.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	peak.exe

flow	ioc
4	discord.com
5	discord.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	peak.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

peak.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	peak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	peak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	peak.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

peak.exe

pid	process
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe
2864	peak.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

peak.exe

description pid process

Token: SeDebugPrivilege 2864 peak.exe

description	pid	process
Token: SeDebugPrivilege	2864	peak.exe

C:\Users\Admin\AppData\Local\Temp\peak.exe
"C:\Users\Admin\AppData\Local\Temp\peak.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-0-0x0000000000010000-0x0000000000EB4000-memory.dmp

Filesize
14.6MB

Download
memory/2864-1-0x0000000076D90000-0x0000000076DD7000-memory.dmp

Filesize
284KB

Download
memory/2864-2-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-3-0x0000000076D90000-0x0000000076DD7000-memory.dmp

Filesize
284KB

Download
memory/2864-4-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-5-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-6-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-7-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-8-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-9-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-11-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-13-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-15-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-17-0x0000000077550000-0x0000000077552000-memory.dmp

Filesize
8KB

Download
memory/2864-19-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-20-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/2864-21-0x0000000000010000-0x0000000000EB4000-memory.dmp

Filesize
14.6MB

Download
memory/2864-22-0x0000000000010000-0x0000000000EB4000-memory.dmp

Filesize
14.6MB

Download
memory/2864-23-0x0000000005D00000-0x0000000005D40000-memory.dmp

Filesize
256KB

Download
memory/2864-24-0x0000000005D00000-0x0000000005D40000-memory.dmp

Filesize
256KB

Download
memory/2864-25-0x00000000063C0000-0x00000000065D2000-memory.dmp

Filesize
2.1MB

Download
memory/2864-27-0x00000000017F0000-0x000000000180A000-memory.dmp

Filesize
104KB

Download
memory/2864-26-0x0000000001470000-0x000000000147A000-memory.dmp

Filesize
40KB

Download
memory/2864-28-0x0000000006950000-0x0000000006A02000-memory.dmp

Filesize
712KB

Download
memory/2864-29-0x0000000005D00000-0x0000000005D40000-memory.dmp

Filesize
256KB

Download
memory/2864-31-0x0000000000010000-0x0000000000EB4000-memory.dmp

Filesize
14.6MB

Download
memory/2864-32-0x0000000076D90000-0x0000000076DD7000-memory.dmp

Filesize
284KB

Download
memory/2864-33-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-34-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-35-0x00000000761F0000-0x0000000076300000-memory.dmp

Filesize
1.1MB

Download
memory/2864-36-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/2864-38-0x0000000005D00000-0x0000000005D40000-memory.dmp

Filesize
256KB

Download
memory/2864-39-0x0000000005D00000-0x0000000005D40000-memory.dmp

Filesize
256KB

Download
memory/2864-40-0x0000000005D00000-0x0000000005D40000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads