agenttesla | 53eeff9f4fa0473d90cf4abe978ff60d5898d2527924a593ef877303cab88a5b

Resubmissions

11/06/2024, 15:38

240611-s26rnssbka 10

11/06/2024, 15:36

240611-s12rbssejn 6

Analysis

max time kernel
25s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Byte Guard Free.exe
Size

2.4MB
MD5

32eee970bec927fd068197918edac5a4
SHA1

8aa4820931aa228856f12fc516f886dab4d12e28
SHA256

53eeff9f4fa0473d90cf4abe978ff60d5898d2527924a593ef877303cab88a5b
SHA512

d47d2fbc9d4b9a47d0b5b1076aaa89b20ba72a9625e9fcfd57f000bc14abc11aff60123667bbb6998fa5bdff65b7207f410cc6008207fc2362db1d99c80afbe8
SSDEEP

49152:3Ls8e8SkGMITYbNbNWo4kSH3OqtwI2MrBm6w30IfRaRf:3PecGMIT4bNJFY3OqtxdmDDJef

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/3520-6-0x0000000006770000-0x0000000006984000-memory.dmp	family_agenttesla

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	discord.com
32	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
6	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Byte Guard Free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Byte Guard Free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Byte Guard Free.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{382F5869-54D8-45E7-9BC1-7639A4C7FCA6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe
3520	Byte Guard Free.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	Byte Guard Free.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 4996	3520	Byte Guard Free.exe	87
PID 3520 wrote to memory of 4996	3520	Byte Guard Free.exe	87
PID 4996 wrote to memory of 4964	4996	msedge.exe	88
PID 4996 wrote to memory of 4964	4996	msedge.exe	88
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 5008	4996	msedge.exe	89
PID 4996 wrote to memory of 3928	4996	msedge.exe	90
PID 4996 wrote to memory of 3928	4996	msedge.exe	90
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91
PID 4996 wrote to memory of 4160	4996	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\Byte Guard Free.exe
"C:\Users\Admin\AppData\Local\Temp\Byte Guard Free.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/g3pH5NZESD
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed05a46f8,0x7ffed05a4708,0x7ffed05a4718
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1448,16909774341836557517,10118205404631120130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,16909774341836557517,10118205404631120130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1448,16909774341836557517,10118205404631120130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,16909774341836557517,10118205404631120130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,16909774341836557517,10118205404631120130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,16909774341836557517,10118205404631120130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1448,16909774341836557517,10118205404631120130,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4084 /prefetch:8
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1448,16909774341836557517,10118205404631120130,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3928 /prefetch:8
    3⤵
    - Modifies registry class
    PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65699be6a0881018dd0bdefb0edb6536

SHA1
134069cbd875903f98d399307a607353d5c00dcd

SHA256
a0c06c71cf13f4eb93dcfc7d40128adba1c3e4a3c0ac7962d586184768c6005c

SHA512
d4d8660bf1c218d7a62fc3a677b4eda8d51f7f662a6ee37d9a28e235fc1cfb43713886aa793c06725fd1c640a4799d2a477d3ffd1d249739e406664f87bc0e74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a89868213c31a8323539592f8c17f3d

SHA1
e2f1574146633e0d4e1a36634db4aa52f95c4b7d

SHA256
d8ad8934a2d89270a982e0b58066b5a225b564e23842c629aea794ccc1c80e1a

SHA512
79a2771ba8f5893e174e5e648c0205bf4e5d123a1b0874fd574d778c36aed121e6c5e2947352806dfb5e374fd2273dd0ff64f07b750c10d1cae553140c8b76cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e2c8ecc9ec01f53702c63ce76f5cf95

SHA1
aae54c49d652efdb4e13733844c9df633fdeca1f

SHA256
4264ffa667c38bbefce77436017000a920df6b00776444543d8756e70e67bf97

SHA512
36d0cfa7ee4f90e0618a61444e3641764f03c5c4da43bd0bc8c10a58a9469c900905eaa94a838daf112808bb2485445dc9597efd4504d2fcda6dcc4c6455ebf8

Download Submit
memory/3520-4-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3520-7-0x0000000006AE0000-0x0000000006AEA000-memory.dmp

Filesize
40KB

Download
memory/3520-8-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3520-9-0x00000000098A0000-0x00000000098DC000-memory.dmp

Filesize
240KB

Download
memory/3520-6-0x0000000006770000-0x0000000006984000-memory.dmp

Filesize
2.1MB

Download
memory/3520-5-0x00000000065A0000-0x00000000065B2000-memory.dmp

Filesize
72KB

Download
memory/3520-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/3520-3-0x0000000005350000-0x00000000053E2000-memory.dmp

Filesize
584KB

Download
memory/3520-117-0x0000000007880000-0x00000000078E6000-memory.dmp

Filesize
408KB

Download
memory/3520-2-0x00000000059F0000-0x0000000005F94000-memory.dmp

Filesize
5.6MB

Download
memory/3520-1-0x00000000006A0000-0x0000000000918000-memory.dmp

Filesize
2.5MB

Download
memory/3520-135-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download