agenttesla | 416de27ffdf83d83d86f1fefa55051e0786ec9a1dd4255067bf58db98698ba19

Analysis

max time kernel
6s
max time network
4s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15-09-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IRFAN X PANEL-protected.exe
Size

3.3MB
MD5

9dd5811d2b68628f26113c52e0a3a36c
SHA1

34eb785d62e4d0af1bc481d93dbdcdaf1864d94e
SHA256

416de27ffdf83d83d86f1fefa55051e0786ec9a1dd4255067bf58db98698ba19
SHA512

c0bb161a06101d175c0842376a051edbd1ee6ceeb17109281c97e898d83e1d5f6098c8809f50e0ce773d50f4454c8c1dbdf42b0625849c52ddc6acc72f80e094
SSDEEP

98304:Af/BjysHjHIT4bNJFY3Oqt3kqXf0FQPM:6/BjNHjHjBHYnkSIQ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/2028-3-0x0000022943C30000-0x0000022943E44000-memory.dmp	family_agenttesla

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	IRFAN X PANEL-protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	IRFAN X PANEL-protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	IRFAN X PANEL-protected.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	IRFAN X PANEL-protected.exe

C:\Users\Admin\AppData\Local\Temp\IRFAN X PANEL-protected.exe
"C:\Users\Admin\AppData\Local\Temp\IRFAN X PANEL-protected.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-0-0x00007FFB86213000-0x00007FFB86215000-memory.dmp

Filesize
8KB

Download
memory/2028-1-0x00000229291B0000-0x0000022929502000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2-0x000002292B100000-0x000002292B112000-memory.dmp

Filesize
72KB

Download
memory/2028-3-0x0000022943C30000-0x0000022943E44000-memory.dmp

Filesize
2.1MB

Download
memory/2028-4-0x00007FFB86210000-0x00007FFB86CD2000-memory.dmp

Filesize
10.8MB

Download
memory/2028-5-0x0000022944740000-0x00000229447F2000-memory.dmp

Filesize
712KB

Download
memory/2028-6-0x00000229447F0000-0x0000022944812000-memory.dmp

Filesize
136KB

Download
memory/2028-8-0x0000022944820000-0x000002294485C000-memory.dmp

Filesize
240KB

Download
memory/2028-9-0x00007FFB86210000-0x00007FFB86CD2000-memory.dmp

Filesize
10.8MB

Download
memory/2028-10-0x00007FFB86210000-0x00007FFB86CD2000-memory.dmp

Filesize
10.8MB

Download