agenttesla | a1351b3dbfc2dc4eafaad6f94cf007c3922ea57c69a89848c0bfb6ef93ee2c4c

Analysis

max time kernel
30s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-09-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DeathCrypter-0.8.0.exe
Size

5.8MB
MD5

fe35580ad68344813946c7ac56f2d004
SHA1

407cbb184834ea4b379b082493359d513da62138
SHA256

a1351b3dbfc2dc4eafaad6f94cf007c3922ea57c69a89848c0bfb6ef93ee2c4c
SHA512

2f22217dabd8e85fa3d99f14feae3f781d5213ede6505c2acb6890cefc0ff45cbb163e015f1c084e3bc6cec627943211268ef2f07089df894cc854bc3256f236
SSDEEP

98304:NTz3yXmUTHPcIUwjCaZQHlt15lxy1N7PUB+4LIN8LijNL/MdYgFz/G/d3XQu9Ljl:NTz3Omg9UwGwA75n+N7PUBHlLWZAXz/c

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/4368-4-0x00000285F6020000-0x00000285F6232000-memory.dmp	family_agenttesla

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4368	DeathCrypter-0.8.0.exe
4368	DeathCrypter-0.8.0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	DeathCrypter-0.8.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	DeathCrypter-0.8.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	DeathCrypter-0.8.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	DeathCrypter-0.8.0.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2568	4368	DeathCrypter-0.8.0.exe	82
PID 4368 wrote to memory of 2568	4368	DeathCrypter-0.8.0.exe	82
PID 2568 wrote to memory of 2936	2568	msedge.exe	83
PID 2568 wrote to memory of 2936	2568	msedge.exe	83
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2028	2568	msedge.exe	84
PID 2568 wrote to memory of 2064	2568	msedge.exe	85
PID 2568 wrote to memory of 2064	2568	msedge.exe	85
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86
PID 2568 wrote to memory of 3408	2568	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\DeathCrypter-0.8.0.exe
"C:\Users\Admin\AppData\Local\Temp\DeathCrypter-0.8.0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/batchcrypter
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff941e23cb8,0x7ff941e23cc8,0x7ff941e23cd8
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,7571026821972795756,5791902417809312383,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,7571026821972795756,5791902417809312383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,7571026821972795756,5791902417809312383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7571026821972795756,5791902417809312383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7571026821972795756,5791902417809312383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7571026821972795756,5791902417809312383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
9e19dd754ed24127378a192433cea672

SHA1
110709856b7035c6a2ae19752c727c72b803f485

SHA256
5fed83d51a252d8325cb4f1e457695eb171d01865ddb156fb91c48ba9e48eecc

SHA512
64c4b89968c090188b0a9186915b436b3f70e46d134fe15cd00e27b684daa9485f5a2a7cd1220231a5c4a82c72258dc24b38171585783c26b9af3c6a0dfa8400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
442B

MD5
967c45526a12a84090cef6dde9eceac2

SHA1
77276b3fff63b5cfc2feb9ef91d155bd5fd361e9

SHA256
31e2b74084cfc23f52f34b658f4ee8017368b1fe38cd4f2a2ddd1cf28930853e

SHA512
49713209d28d5e23ea90e4357f7300cb6839fd5c192c95b7fd04a6401a1b22ed152f4f79a954a7ea79044842ea57041c8920cfabb2c4d535e4c39f240df67201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f63f119b11853092024c2c25768bd06

SHA1
e88cf3181a149027b5885ce130c466beca5ec6fc

SHA256
6717b20b41c9480f31a59557a199dd27b33f945439f4153fb4c8f46b72ed02ff

SHA512
9ba1118fb1513060b49a44488a2979755619180749cadca845a6566c5da195858fc2df853036a14d8fb712ffe0cd588edb77152fa00c6d49b8c356470cffd838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c8ea516da583ecc37d7bcfd1be24082

SHA1
4ed832852666566707ae33043a67fc8c5a004068

SHA256
0289e220ae02dadb77d6292fc78ccc06aaf6557c1392de5ec657b72f297d2835

SHA512
18da91c1bf609973e8b22f56bd3c155955009964d35a2bc4671666276b58dfd3b7d18edcada8886356b834aeb7e2cbd8d07654738e711d5ec216f4e832a1a073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
17c40af801fd7d91b4d4a3dc40445f78

SHA1
eabc931dcb5a98cd08a5d4383d0888c74ea89230

SHA256
a3fed985009406dc6be3f461be124d54b7cd65bb33055d5d16db9cabc5346ae6

SHA512
3524fb6015e67185e5fda326cc7b2f5c3a5ab33659d991e5e3db66dccb033de69eb674cfea56aafd7ba5afad9ba8899402f26a80a4af9eac25a8c80cb0d3bee8

Download Submit
memory/4368-8-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-5-0x00000285F6230000-0x00000285F63A2000-memory.dmp

Filesize
1.4MB

Download
memory/4368-10-0x00000285F6530000-0x00000285F6552000-memory.dmp

Filesize
136KB

Download
memory/4368-19-0x00000285F7B80000-0x00000285F7D52000-memory.dmp

Filesize
1.8MB

Download
memory/4368-20-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-9-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-30-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-0-0x00007FF9480D3000-0x00007FF9480D5000-memory.dmp

Filesize
8KB

Download
memory/4368-7-0x00000285DD600000-0x00000285DD612000-memory.dmp

Filesize
72KB

Download
memory/4368-53-0x00007FF9480D3000-0x00007FF9480D5000-memory.dmp

Filesize
8KB

Download
memory/4368-6-0x00000285DD650000-0x00000285DD700000-memory.dmp

Filesize
704KB

Download
memory/4368-12-0x00000285F6560000-0x00000285F659C000-memory.dmp

Filesize
240KB

Download
memory/4368-4-0x00000285F6020000-0x00000285F6232000-memory.dmp

Filesize
2.1MB

Download
memory/4368-3-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-2-0x00000285DBD60000-0x00000285DBD61000-memory.dmp

Filesize
4KB

Download
memory/4368-1-0x00000285DAB00000-0x00000285DB948000-memory.dmp

Filesize
14.3MB

Download
memory/4368-157-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-158-0x00000285F67F0000-0x00000285F69A3000-memory.dmp

Filesize
1.7MB

Download
memory/4368-159-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-160-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-161-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-162-0x00007FF9480D0000-0x00007FF948B92000-memory.dmp

Filesize
10.8MB

Download
memory/4368-163-0x00000285F67F0000-0x00000285F69A3000-memory.dmp

Filesize
1.7MB

Download
memory/4368-165-0x00000285F67F0000-0x00000285F69A3000-memory.dmp

Filesize
1.7MB

Download