agenttesla | 0a13e3279eca443d8e25bcc1c7e1bc6701fc4ab4dade37a7a52995a09f33ff39

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dist.exe
Size

3.6MB
MD5

f361f816f04927b3141122a57f2f3f82
SHA1

409cf10a30f668bcd1f6becdcc9089849b3d18ac
SHA256

0a13e3279eca443d8e25bcc1c7e1bc6701fc4ab4dade37a7a52995a09f33ff39
SHA512

f4aee7372d58f8099e6290375d92277a8e8c118941d9c3020bcaa88c8cac6df04b97832b5b412bffe27278e636aa53fd7e9315d473892aadf94a119377dbca02
SSDEEP

98304:Ok5IT4bNJFY3Oqt/h+KH4kpc+DX/0H4feb5CE:Ok5jBHYYKYODJebgE

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3092-2-0x0000020F64360000-0x0000020F64574000-memory.dmp	family_agenttesla

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Dist.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Dist.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Dist.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Dist.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Dist.exe

pid process

3092 Dist.exe
3092 Dist.exe
3092 Dist.exe
3092 Dist.exe
3092 Dist.exe
3092 Dist.exe
3092 Dist.exe
3092 Dist.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Dist.exe

description pid process

Token: SeDebugPrivilege 3092 Dist.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Dist.exe

pid process

3092 Dist.exe
3092 Dist.exe

pid	process
3092	Dist.exe
3092	Dist.exe
3092	Dist.exe
3092	Dist.exe
3092	Dist.exe
3092	Dist.exe
3092	Dist.exe
3092	Dist.exe

description	pid	process
Token: SeDebugPrivilege	3092	Dist.exe

pid	process
3092	Dist.exe
3092	Dist.exe

C:\Users\Admin\AppData\Local\Temp\Dist.exe
"C:\Users\Admin\AppData\Local\Temp\Dist.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3092-0-0x00007FFF98773000-0x00007FFF98775000-memory.dmp

Filesize
8KB

Download
memory/3092-1-0x0000020F497F0000-0x0000020F49B84000-memory.dmp

Filesize
3.6MB

Download
memory/3092-2-0x0000020F64360000-0x0000020F64574000-memory.dmp

Filesize
2.1MB

Download
memory/3092-3-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download
memory/3092-4-0x0000020F64570000-0x0000020F64976000-memory.dmp

Filesize
4.0MB

Download
memory/3092-5-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download
memory/3092-6-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download
memory/3092-7-0x0000020F64980000-0x0000020F650D7000-memory.dmp

Filesize
7.3MB

Download
memory/3092-8-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download