Overview

overview

10

Static

static

3

Byte Guard Free.exe

windows10-1703-x64

10

Byte Guard Free.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-07-2024 07:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Byte Guard Free.exe

  • Size

    2.4MB

  • MD5

    32eee970bec927fd068197918edac5a4

  • SHA1

    8aa4820931aa228856f12fc516f886dab4d12e28

  • SHA256

    53eeff9f4fa0473d90cf4abe978ff60d5898d2527924a593ef877303cab88a5b

  • SHA512

    d47d2fbc9d4b9a47d0b5b1076aaa89b20ba72a9625e9fcfd57f000bc14abc11aff60123667bbb6998fa5bdff65b7207f410cc6008207fc2362db1d99c80afbe8

  • SSDEEP

    49152:3Ls8e8SkGMITYbNbNWo4kSH3OqtwI2MrBm6w30IfRaRf:3PecGMIT4bNJFY3OqtxdmDDJef

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 5 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Byte Guard Free.exe
    "C:\Users\Admin\AppData\Local\Temp\Byte Guard Free.exe"
    1⤵
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1628
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2500
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:3680
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2352
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4308
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:2164
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3456
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:3720
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:2672

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BU0KRETY\edgecompatviewlist[1].xml
    Filesize

    74KB

    MD5

    d4fc49dc14f63895d997fa4940f24378

    SHA1

    3efb1437a7c5e46034147cbbc8db017c69d02c31

    SHA256

    853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

    SHA512

    cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ITNUMXLP\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\R79PBX9D\favicon[1].ico
    Filesize

    23KB

    MD5

    ec2c34cadd4b5f4594415127380a85e6

    SHA1

    e7e129270da0153510ef04a148d08702b980b679

    SHA256

    128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

    SHA512

    c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    Filesize

    1KB

    MD5

    18ebae71becff9dc0cd7d2773eab206d

    SHA1

    0871d140b0d8799f8c6159b8f88040b691bfb8af

    SHA256

    ede512725bd832937e4fdd224a4f415df9f8b384563fe12ae5bd12697ae05763

    SHA512

    617f38d2d2c6b4068f7949ab8d8e3da49f2031992d5bde513f8352f95ffc67ac495577f1c906f9b2278c33743f3f73679944442e38dcdd3c65e6ed4ea63084a3

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    Filesize

    408B

    MD5

    355c12714d0f5100cc3ff6aeef13ca6a

    SHA1

    3653f607ed1382f447a529060819720676afc24e

    SHA256

    b8a2a03b1dab174d3a4b00d89e3a49f621475aa342cafbdfe83247a061dbf492

    SHA512

    55f97332c78deae823e7f53abd2df5d251abd4dd6ee49c6be62fdb9b4c525ee67e5e043cbf37d719428aeb219d319f3e7d6bb887cfb50cd75f4f44a421a29e81

    Download Submit
  • memory/1628-5-0x0000000005E80000-0x0000000006094000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/1628-3-0x0000000004C50000-0x0000000004CE2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/1628-7-0x0000000008EF0000-0x0000000008F2E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1628-0-0x00007FFDFC070000-0x00007FFDFC24B000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1628-6-0x00000000061C0000-0x00000000061CA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1628-1-0x0000000000150000-0x00000000003C8000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1628-47-0x0000000009B80000-0x0000000009BE6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/1628-2-0x0000000005070000-0x000000000556E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1628-60-0x00007FFDFC070000-0x00007FFDFC24B000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1628-4-0x0000000005CB0000-0x0000000005CC2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2500-24-0x0000022645D20000-0x0000022645D30000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2500-137-0x000002264C3A0000-0x000002264C3A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2500-43-0x0000022644D40000-0x0000022644D42000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2500-8-0x0000022645C20000-0x0000022645C30000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2500-138-0x000002264C3B0000-0x000002264C3B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3720-83-0x000001F3C26D0000-0x000001F3C26D2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3720-85-0x000001F3C2AF0000-0x000001F3C2AF2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3720-87-0x000001F3C2B10000-0x000001F3C2B12000-memory.dmp
    Filesize

    8KB

    Download
  • memory/4308-51-0x0000022251E20000-0x0000022251F20000-memory.dmp
    Filesize

    1024KB

    Download