agenttesla | 5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64

Analysis

max time kernel
183s
max time network
151s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
02-08-2022 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe
Size

519KB
MD5

0e8bd35ef43d424f440a3164b6be511f
SHA1

d080400cbcbd9e4e10041ef7bdf383268707ce83
SHA256

5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64
SHA512

72eb8de3ca9347ea5525417c94f9af4cbd6f9d77706fd894bed2e7013c5efd3aa67a1143f3e1031c1319a701d7fa74d81cae2906ca037082061ef580da1ecc0f

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyOtApp = "C:\\Users\\Admin\\AppData\\Roaming\\MyOtApp\\MyOtApp.exe"	RegAsm.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe

description	pid	process	target process
PID 1704 set thread context of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegAsm.exe

pid process

2044 RegAsm.exe
2044 RegAsm.exe

pid	process
2044	RegAsm.exe
2044	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe
Token: SeDebugPrivilege	2044	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe

description	pid	process	target process
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe
PID 1704 wrote to memory of 2044	1704	5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe
"C:\Users\Admin\AppData\Local\Temp\5a5d5b0c3917a59751c4c8404f9711b07395f058a29187fc3a37c2db94a0cc64.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-54-0x0000000000280000-0x0000000000308000-memory.dmp

Filesize
544KB

Download
memory/1704-55-0x0000000001C80000-0x0000000001C90000-memory.dmp

Filesize
64KB

Download
memory/1704-56-0x0000000075DC1000-0x0000000075DC3000-memory.dmp

Filesize
8KB

Download
memory/2044-57-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2044-58-0x000000000043413E-mapping.dmp

Download
memory/2044-60-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2044-62-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download