agenttesla | 8fdbff40ffb8d74aac4a41da26ba2a21d7d5c624b0281fbeaab0a5ea563d113a

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MasonRootkit-main/RootkitBuilder.exe
Size

1.9MB
MD5

c58cd9b7da83204709759dc5e0651ded
SHA1

38af136bf8c6d59072b5d726599f133fdde87e68
SHA256

9a5458bada986bcf60167b916f1eaec91dba0f31d10fcba6d1647a3c157dac45
SHA512

b27528ab44e8c41b226468c5a66fbed964f863989f1c9954532b9c22c1b8ab64003f150acf77d4ea00993e3500f8b370a6d1aba1b5031739598eefa8a949799e
SSDEEP

24576:xpgBmJY0T+Mql2mfH2aQREktRz0sHJzVhCLFs39j2MuTk9WxIPiPf9w5pxK:fZy0RqlxP2apktZ0spzVUQl9WKr5

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral7/memory/2696-13-0x00000000051E0000-0x00000000053F2000-memory.dmp	family_agenttesla

Loads dropped DLL 1 IoCs

pid	Process
2696	RootkitBuilder.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RootkitBuilder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RootkitBuilder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RootkitBuilder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	RootkitBuilder.exe

C:\Users\Admin\AppData\Local\Temp\MasonRootkit-main\RootkitBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\MasonRootkit-main\RootkitBuilder.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\FLZVP.dll

Filesize
84KB

MD5
0b0e63957367e620b8697c5341af35b9

SHA1
69361c2762b2d1cada80667cd55bc5082e60af86

SHA256
bd9cdcfaa0edecdb89a204965d20f4a896c6650d4840e28736d9bd832390e1c5

SHA512
07d0e52c863f52ecb3d12fab9e71c7a18d54cbedb47250bee7e4297ff72ed793c23a2735c48090c261fe4633d53d03e305c1338dfc881bb86874d1633ff6ecee

Download Submit
memory/2696-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Filesize
4KB

Download
memory/2696-1-0x0000000000250000-0x0000000000438000-memory.dmp

Filesize
1.9MB

Download
memory/2696-5-0x00000000050A0000-0x00000000051D8000-memory.dmp

Filesize
1.2MB

Download
memory/2696-6-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-7-0x0000000000590000-0x00000000005BA000-memory.dmp

Filesize
168KB

Download
memory/2696-8-0x0000000000610000-0x000000000062C000-memory.dmp

Filesize
112KB

Download
memory/2696-13-0x00000000051E0000-0x00000000053F2000-memory.dmp

Filesize
2.1MB

Download
memory/2696-14-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-15-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Filesize
4KB

Download
memory/2696-16-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download