agenttesla | f4aea90790ab8eb0da7876eee1a1f2e56505cd7f9a8d4a2125c9bc2a2254b03e

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spoofer.exe
Size

5.6MB
MD5

05b8c2b4dcdc13f67f4c9e95c3160091
SHA1

efa4e9cd3dcc41b33e966623a21f00dca13d989a
SHA256

f4aea90790ab8eb0da7876eee1a1f2e56505cd7f9a8d4a2125c9bc2a2254b03e
SHA512

4319911fffa5c1a0b5536d0f5cca742c9eaa6de023b0ec392dad3b39bf80234ae3b685a7b98cb80811bc22efa327cff7c4172e92df39d929d3fc1dc53157b71c
SSDEEP

98304:z6zFPIT4bNJFY3Oqt+3B5I6klntULx//9eLFVRYMq1cRd5ja268I9X6Lex5uTkq9:ezljBHYO3BZLxH8L/RYMi8LallZ6lTko

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/2796-3-0x0000000005440000-0x0000000005654000-memory.dmp	family_agenttesla

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoofer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	spoofer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	spoofer.exe

C:\Users\Admin\AppData\Local\Temp\spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\spoofer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-0-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/2796-1-0x0000000000AE0000-0x0000000001076000-memory.dmp

Filesize
5.6MB

Download
memory/2796-2-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/2796-3-0x0000000005440000-0x0000000005654000-memory.dmp

Filesize
2.1MB

Download
memory/2796-4-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/2796-5-0x00000000064B0000-0x0000000006562000-memory.dmp

Filesize
712KB

Download
memory/2796-6-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/2796-7-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download