agenttesla | 328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725

Analysis

max time kernel
62s
max time network
123s
platform
windows10_x64
resource
win10v20201028
submitted
24-11-2020 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe
Size

590KB
MD5

6611edb58235884e8499d12cdfa808be
SHA1

7d1f2d13c59930dbb8e2547f3748215da9f20ee9
SHA256

a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d
SHA512

283769a041c725cfca6501b47979d8a51695535f701dca45d0c444a5e0d903e40a19ca98adc26f54998f2a4c27b9772bd821196c19f2b6ba485c837d79c803c2

Score

10^/10

agenttesla redline discovery infostealer keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

AgentTesla Payload 2 IoCs

keylogger stealer

Processes:

resource	yara_rule
behavioral14/memory/2696-11-0x0000000000400000-0x0000000000426000-memory.dmp	agent_tesla
behavioral14/memory/2696-12-0x000000000042040E-mapping.dmp	agent_tesla

Executes dropped EXE 2 IoCs

Processes:

BubbleBrowser.exeBubbleBrowser.exe

pid process

2072 BubbleBrowser.exe
2696 BubbleBrowser.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 checkip.amazonaws.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

BubbleBrowser.exe

description pid process target process

PID 2072 set thread context of 2696 2072 BubbleBrowser.exe BubbleBrowser.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

816 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

BubbleBrowser.exe

pid process

2696 BubbleBrowser.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

BubbleBrowser.exeBubbleBrowser.exe

description pid process

Token: SeDebugPrivilege 2072 BubbleBrowser.exe
Token: SeDebugPrivilege 2696 BubbleBrowser.exe

pid	process
2072	BubbleBrowser.exe
2696	BubbleBrowser.exe

flow	ioc
28	checkip.amazonaws.com

description	pid	process	target process
PID 2072 set thread context of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe

pid	process
816	PING.EXE

pid	process
2696	BubbleBrowser.exe

description	pid	process
Token: SeDebugPrivilege	2072	BubbleBrowser.exe
Token: SeDebugPrivilege	2696	BubbleBrowser.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exeBubbleBrowser.exeBubbleBrowser.execmd.exe

description	pid	process	target process
PID 988 wrote to memory of 2072	988	a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe	BubbleBrowser.exe
PID 988 wrote to memory of 2072	988	a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe	BubbleBrowser.exe
PID 988 wrote to memory of 2072	988	a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe	BubbleBrowser.exe
PID 2072 wrote to memory of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe
PID 2072 wrote to memory of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe
PID 2072 wrote to memory of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe
PID 2072 wrote to memory of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe
PID 2072 wrote to memory of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe
PID 2072 wrote to memory of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe
PID 2072 wrote to memory of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe
PID 2072 wrote to memory of 2696	2072	BubbleBrowser.exe	BubbleBrowser.exe
PID 2696 wrote to memory of 2740	2696	BubbleBrowser.exe	cmd.exe
PID 2696 wrote to memory of 2740	2696	BubbleBrowser.exe	cmd.exe
PID 2696 wrote to memory of 2740	2696	BubbleBrowser.exe	cmd.exe
PID 2740 wrote to memory of 816	2740	cmd.exe	PING.EXE
PID 2740 wrote to memory of 816	2740	cmd.exe	PING.EXE
PID 2740 wrote to memory of 816	2740	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe
"C:\Users\Admin\AppData\Local\Temp\a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:988

C:\Users\Admin\AppData\Roaming\BubbleBrowser.exe
C:\Users\Admin\AppData\Roaming\BubbleBrowser.exe daut
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Roaming\BubbleBrowser.exe
"C:\Users\Admin\AppData\Roaming\BubbleBrowser.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C ping 127.0.0.1 -n 3 > nul &del "C:\Users\Admin\AppData\Roaming\BubbleBrowser.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
5⤵
- Runs ping.exe
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BubbleBrowser.exe.log
MD5
9e7845217df4a635ec4341c3d52ed685

SHA1
d65cb39d37392975b038ce503a585adadb805da5

SHA256
d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b

SHA512
307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1

Download Submit
C:\Users\Admin\AppData\Roaming\BubbleBrowser.exe
MD5
11d71c92fb114168431892a73963cb15

SHA1
6467448f5b6dfb4f0cd77e218e6e4bfbe8a61696

SHA256
18f4e6a6483a5684d61942d56cc20abc1ed690aa03910c9a3ebe24e71da8cf94

SHA512
e3d2b822acf17d3c63e1efad5ef2dfc5ff3a2fdbed9a1b3791e1175fc674f62c0be2ef618d0a4a36e4e5c96c5399a3d53e0e3c0102b2a9324aa30641d301e6be

Download Submit
C:\Users\Admin\AppData\Roaming\BubbleBrowser.exe
MD5
11d71c92fb114168431892a73963cb15

SHA1
6467448f5b6dfb4f0cd77e218e6e4bfbe8a61696

SHA256
18f4e6a6483a5684d61942d56cc20abc1ed690aa03910c9a3ebe24e71da8cf94

SHA512
e3d2b822acf17d3c63e1efad5ef2dfc5ff3a2fdbed9a1b3791e1175fc674f62c0be2ef618d0a4a36e4e5c96c5399a3d53e0e3c0102b2a9324aa30641d301e6be

Download Submit
C:\Users\Admin\AppData\Roaming\BubbleBrowser.exe
MD5
11d71c92fb114168431892a73963cb15

SHA1
6467448f5b6dfb4f0cd77e218e6e4bfbe8a61696

SHA256
18f4e6a6483a5684d61942d56cc20abc1ed690aa03910c9a3ebe24e71da8cf94

SHA512
e3d2b822acf17d3c63e1efad5ef2dfc5ff3a2fdbed9a1b3791e1175fc674f62c0be2ef618d0a4a36e4e5c96c5399a3d53e0e3c0102b2a9324aa30641d301e6be

Download Submit
memory/816-32-0x0000000000000000-mapping.dmp

Download
memory/2072-8-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/2072-4-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/2072-0-0x0000000000000000-mapping.dmp

Download
memory/2072-9-0x00000000072D0000-0x000000000730C000-memory.dmp

Filesize
240KB

Download
memory/2072-10-0x0000000007310000-0x0000000007326000-memory.dmp

Filesize
88KB

Download
memory/2072-3-0x0000000073800000-0x0000000073EEE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-7-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/2072-6-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

Filesize
4KB

Download
memory/2696-19-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/2696-25-0x00000000072B0000-0x00000000072B1000-memory.dmp

Filesize
4KB

Download
memory/2696-18-0x0000000005F90000-0x0000000005F91000-memory.dmp

Filesize
4KB

Download
memory/2696-12-0x000000000042040E-mapping.dmp

Download
memory/2696-20-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/2696-21-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2696-22-0x0000000005A90000-0x0000000005A91000-memory.dmp

Filesize
4KB

Download
memory/2696-15-0x0000000073800000-0x0000000073EEE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-26-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/2696-27-0x0000000007480000-0x0000000007481000-memory.dmp

Filesize
4KB

Download
memory/2696-28-0x00000000077F0000-0x00000000077F1000-memory.dmp

Filesize
4KB

Download
memory/2696-29-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

Filesize
4KB

Download
memory/2696-30-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

Filesize
4KB

Download
memory/2696-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2740-31-0x0000000000000000-mapping.dmp

Download