Overview
overview
10Static
static
10Debug/Guna.UI2.dll
windows7-x64
1Debug/Guna.UI2.dll
windows10-2004-x64
1Debug/Micr...es.dll
windows7-x64
1Debug/Micr...es.dll
windows10-2004-x64
1Debug/Newt...on.dll
windows7-x64
1Debug/Newt...on.dll
windows10-2004-x64
1Debug/Siti...UI.dll
windows7-x64
1Debug/Siti...UI.dll
windows10-2004-x64
1Debug/Syst...rs.dll
windows7-x64
1Debug/Syst...rs.dll
windows10-2004-x64
1Debug/Syst...ry.dll
windows7-x64
1Debug/Syst...ry.dll
windows10-2004-x64
1Debug/Syst...rs.dll
windows7-x64
1Debug/Syst...rs.dll
windows10-2004-x64
1Debug/Syst...fe.dll
windows7-x64
1Debug/Syst...fe.dll
windows10-2004-x64
1Debug/Syst...ws.dll
windows7-x64
1Debug/Syst...ws.dll
windows10-2004-x64
1Debug/Syst...ls.dll
windows7-x64
1Debug/Syst...ls.dll
windows10-2004-x64
1Debug/Syst...ns.dll
windows7-x64
1Debug/Syst...ns.dll
windows10-2004-x64
1Debug/Syst...le.dll
windows7-x64
1Debug/Syst...le.dll
windows10-2004-x64
1Debug/Wind...p3.exe
windows7-x64
10Debug/Wind...p3.exe
windows10-2004-x64
10Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 10:36
Behavioral task
behavioral1
Sample
Debug/Guna.UI2.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Debug/Guna.UI2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Debug/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Debug/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Debug/Newtonsoft.Json.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Debug/Newtonsoft.Json.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Debug/Siticone.Desktop.UI.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Debug/Siticone.Desktop.UI.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Debug/System.Buffers.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Debug/System.Buffers.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Debug/System.Memory.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Debug/System.Memory.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Debug/System.Numerics.Vectors.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Debug/System.Numerics.Vectors.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Debug/System.Runtime.CompilerServices.Unsafe.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Debug/System.Runtime.CompilerServices.Unsafe.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Debug/System.Security.Principal.Windows.dll
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
Debug/System.Security.Principal.Windows.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Debug/System.Threading.Channels.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Debug/System.Threading.Channels.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Debug/System.Threading.Tasks.Extensions.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Debug/System.Threading.Tasks.Extensions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Debug/System.ValueTuple.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
Debug/System.ValueTuple.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Debug/WindowsFormsApp3.exe
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Debug/WindowsFormsApp3.exe
Resource
win10v2004-20240426-en
General
-
Target
Debug/WindowsFormsApp3.exe
-
Size
60KB
-
MD5
908af5f82388e8676a159ce783abb032
-
SHA1
51741644cf5de4d122c6162628c9e227e9cf0442
-
SHA256
d16f4a167c92bc48db3a7e1f7064893a3b4705b434c688045268c918b41bebb4
-
SHA512
9cca21329f07dfab73668faef9baa6f314730a8ca42f9ed9857817f9b2e8a81aa1c2036b1e09fbd2848c75d5429c828ad045df38a1c73493bff0ca25521d6235
-
SSDEEP
1536:lJj3sOrUo1A89+01bo8N92+tkT6EgkykCWxsCOCQGJ57gFOGRO538:lJjcOrUo1A8T1bo8HtkT6EgkaGJb0O5M
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral25/memory/2940-2-0x0000000004CD0000-0x0000000004EE4000-memory.dmp family_agenttesla -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS WindowsFormsApp3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer WindowsFormsApp3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion WindowsFormsApp3.exe