Analysis

  • max time kernel
    43s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 20:14

General

  • Target

    Argon.exe

  • Size

    3.4MB

  • MD5

    6b69d0e5937d85dce0096deaa29252f1

  • SHA1

    1ba0c37ba6844faeb07c8021e05bd539fa4b4c1d

  • SHA256

    37fcfde84cec0c6b88abc35246c39eba163bfb8fdaae2a841c91a6caab129ba6

  • SHA512

    52e6cc4652890e9d3bf7eae1e0f910ecdd326cab6846f34c71cf27e772f2c677d632aa0d498a2d66f6c90008e25e849fc4d8ce13234278eb605f7abebad1a0d1

  • SSDEEP

    98304:JsxCGsTt3WdAa8NwC7/1Od2X5fVqtIAuLUf:UCGsTt3Wmz7/1vdVqZnf

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Argon.exe
    "C:\Users\Admin\AppData\Local\Temp\Argon.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1556-0-0x0000023A6A720000-0x0000023A6AA98000-memory.dmp

    Filesize

    3.5MB

  • memory/1556-1-0x0000023A6CE30000-0x0000023A6D3C4000-memory.dmp

    Filesize

    5.6MB

  • memory/1556-2-0x00007FFBD93B0000-0x00007FFBD9E71000-memory.dmp

    Filesize

    10.8MB

  • memory/1556-3-0x0000023A6D520000-0x0000023A6D530000-memory.dmp

    Filesize

    64KB

  • memory/1556-4-0x0000023A6D760000-0x0000023A6D812000-memory.dmp

    Filesize

    712KB

  • memory/1556-5-0x0000023A6D6E0000-0x0000023A6D702000-memory.dmp

    Filesize

    136KB

  • memory/1556-7-0x0000023A6F790000-0x0000023A6F986000-memory.dmp

    Filesize

    2.0MB

  • memory/1556-8-0x0000023A6D820000-0x0000023A6D882000-memory.dmp

    Filesize

    392KB

  • memory/1556-9-0x0000023A6D520000-0x0000023A6D530000-memory.dmp

    Filesize

    64KB

  • memory/1556-10-0x0000023A70990000-0x0000023A709A2000-memory.dmp

    Filesize

    72KB

  • memory/1556-11-0x0000023A70B40000-0x0000023A70B7C000-memory.dmp

    Filesize

    240KB

  • memory/1556-12-0x00007FFBD93B0000-0x00007FFBD9E71000-memory.dmp

    Filesize

    10.8MB

  • memory/1556-13-0x0000023A6D520000-0x0000023A6D530000-memory.dmp

    Filesize

    64KB

  • memory/1556-14-0x0000023A6D520000-0x0000023A6D530000-memory.dmp

    Filesize

    64KB