agenttesla | fbe79d5be3c54c322b4417a1633fa98fae73da97e30da6e22647aaa8ea47ec3f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaspLoader.exe
Size

1.7MB
MD5

ded7171654d9f359e3f920bd97eea82a
SHA1

211ae6a3d881adc8a88e2ae625ae783342b2d572
SHA256

fbe79d5be3c54c322b4417a1633fa98fae73da97e30da6e22647aaa8ea47ec3f
SHA512

8bf30b9316f02fc9deaa808c7d47eaede9238242aa38f78954297ed3348d7e2272cd2c26160a6d0a841eeef1d532ad63734e77888926ba0b25b6e253dacfade2
SSDEEP

49152:9aP1jE577CLgoGZCn9WlGHQz+YmQxbxipU8IlJtLaSgwSreHTXRY1Ix798Lsqbv1:9aP1jE577CLgoGZCn9WlGHQz+YmQxbxQ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

resource	yara_rule
behavioral1/memory/2520-3-0x000000001B9F0000-0x000000001BCFC000-memory.dmp	family_agenttesla
behavioral1/memory/2520-4-0x000000001BD00000-0x000000001BF12000-memory.dmp	family_agenttesla

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WaspLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WaspLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	WaspLoader.exe

C:\Users\Admin\AppData\Local\Temp\WaspLoader.exe
"C:\Users\Admin\AppData\Local\Temp\WaspLoader.exe"
1⤵
- Enumerates system info in registry
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-0-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Filesize
4KB

Download
memory/2520-1-0x0000000000E20000-0x0000000000FE0000-memory.dmp

Filesize
1.8MB

Download
memory/2520-2-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-3-0x000000001B9F0000-0x000000001BCFC000-memory.dmp

Filesize
3.0MB

Download
memory/2520-4-0x000000001BD00000-0x000000001BF12000-memory.dmp

Filesize
2.1MB

Download
memory/2520-5-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-6-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Filesize
4KB

Download
memory/2520-7-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-8-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-9-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download