agenttesla | e0eea0acc8a4a815ae242bfdf45b27129cbb9bdfeb1c897f58b6f5c0c771a5eb

Analysis

max time kernel
152s
max time network
159s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Lazy.254108.23652.exe
Size

294KB
MD5

c3790fa0a84ee89f33cf7f64d21bf00f
SHA1

9b5a2c1b7ec6e0d85ead32e0213b35a71c765ac0
SHA256

e0eea0acc8a4a815ae242bfdf45b27129cbb9bdfeb1c897f58b6f5c0c771a5eb
SHA512

fbfe49f38019224e8c6327004592b52b806df6c80e3f5c66296f78a3c38b48cbba85170b832a58ad0b373599a80117226e2301bc182f8087497452e4b8de4366
SSDEEP

6144:chEvm4FPzdMrshrR92O2bSrIVuHayn8y5REr:c5iMe+bSrINy5R

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

http://107.189.4.253/boots/inc/a155b6dca5b411.php

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2040	smg.exe
1828	smg.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org
8	api.ipify.org
9	api.ipify.org

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 2040 set thread context of 996	2040	smg.exe	39
PID 1828 set thread context of 1508	1828	smg.exe	48

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
924	schtasks.exe
1752	schtasks.exe
2008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1144	vbc.exe
1144	vbc.exe
1144	vbc.exe
996	vbc.exe
996	vbc.exe
996	vbc.exe
1508	vbc.exe
1508	vbc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	vbc.exe
Token: SeDebugPrivilege	996	vbc.exe
Token: SeDebugPrivilege	1508	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1144	vbc.exe
996	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1144	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	28
PID 1912 wrote to memory of 1772	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	29
PID 1912 wrote to memory of 1772	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	29
PID 1912 wrote to memory of 1772	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	29
PID 1912 wrote to memory of 1772	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	29
PID 1912 wrote to memory of 2036	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	31
PID 1912 wrote to memory of 2036	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	31
PID 1912 wrote to memory of 2036	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	31
PID 1912 wrote to memory of 2036	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	31
PID 1912 wrote to memory of 1872	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	33
PID 1912 wrote to memory of 1872	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	33
PID 1912 wrote to memory of 1872	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	33
PID 1912 wrote to memory of 1872	1912	SecuriteInfo.com.Variant.Lazy.254108.23652.exe	33
PID 2036 wrote to memory of 924	2036	cmd.exe	34
PID 2036 wrote to memory of 924	2036	cmd.exe	34
PID 2036 wrote to memory of 924	2036	cmd.exe	34
PID 2036 wrote to memory of 924	2036	cmd.exe	34
PID 1776 wrote to memory of 2040	1776	taskeng.exe	38
PID 1776 wrote to memory of 2040	1776	taskeng.exe	38
PID 1776 wrote to memory of 2040	1776	taskeng.exe	38
PID 1776 wrote to memory of 2040	1776	taskeng.exe	38
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 996	2040	smg.exe	39
PID 2040 wrote to memory of 1844	2040	smg.exe	40
PID 2040 wrote to memory of 1844	2040	smg.exe	40
PID 2040 wrote to memory of 1844	2040	smg.exe	40
PID 2040 wrote to memory of 1844	2040	smg.exe	40
PID 2040 wrote to memory of 1672	2040	smg.exe	41
PID 2040 wrote to memory of 1672	2040	smg.exe	41
PID 2040 wrote to memory of 1672	2040	smg.exe	41
PID 2040 wrote to memory of 1672	2040	smg.exe	41
PID 2040 wrote to memory of 1216	2040	smg.exe	42
PID 2040 wrote to memory of 1216	2040	smg.exe	42
PID 2040 wrote to memory of 1216	2040	smg.exe	42
PID 2040 wrote to memory of 1216	2040	smg.exe	42
PID 1672 wrote to memory of 1752	1672	cmd.exe	46
PID 1672 wrote to memory of 1752	1672	cmd.exe	46
PID 1672 wrote to memory of 1752	1672	cmd.exe	46
PID 1672 wrote to memory of 1752	1672	cmd.exe	46
PID 1776 wrote to memory of 1828	1776	taskeng.exe	47
PID 1776 wrote to memory of 1828	1776	taskeng.exe	47
PID 1776 wrote to memory of 1828	1776	taskeng.exe	47
PID 1776 wrote to memory of 1828	1776	taskeng.exe	47
PID 1828 wrote to memory of 1508	1828	smg.exe	48
PID 1828 wrote to memory of 1508	1828	smg.exe	48
PID 1828 wrote to memory of 1508	1828	smg.exe	48
PID 1828 wrote to memory of 1508	1828	smg.exe	48
PID 1828 wrote to memory of 1508	1828	smg.exe	48
PID 1828 wrote to memory of 1508	1828	smg.exe	48

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.254108.23652.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.254108.23652.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1144
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\smg"
  2⤵
  PID:1772
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\smg\smg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\smg\smg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:924
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.254108.23652.exe" "C:\Users\Admin\AppData\Local\Temp\smg\smg.exe"
  2⤵
  PID:1872

C:\Windows\system32\taskeng.exe
taskeng.exe {D7B6B29B-7F9D-4BBD-822B-9AB14FC8DECA} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\smg\smg.exe
  C:\Users\Admin\AppData\Local\Temp\smg\smg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\smg"
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\smg\smg.exe'" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\smg\smg.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\smg\smg.exe" "C:\Users\Admin\AppData\Local\Temp\smg\smg.exe"
    3⤵
    PID:1216
- C:\Users\Admin\AppData\Local\Temp\smg\smg.exe
  C:\Users\Admin\AppData\Local\Temp\smg\smg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\smg"
    3⤵
    PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\smg\smg.exe'" /f
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\smg\smg.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\smg\smg.exe" "C:\Users\Admin\AppData\Local\Temp\smg\smg.exe"
    3⤵
    PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\smg\smg.exe

Filesize
294KB

MD5
c3790fa0a84ee89f33cf7f64d21bf00f

SHA1
9b5a2c1b7ec6e0d85ead32e0213b35a71c765ac0

SHA256
e0eea0acc8a4a815ae242bfdf45b27129cbb9bdfeb1c897f58b6f5c0c771a5eb

SHA512
fbfe49f38019224e8c6327004592b52b806df6c80e3f5c66296f78a3c38b48cbba85170b832a58ad0b373599a80117226e2301bc182f8087497452e4b8de4366

Download Submit
C:\Users\Admin\AppData\Local\Temp\smg\smg.exe

Filesize
294KB

MD5
c3790fa0a84ee89f33cf7f64d21bf00f

SHA1
9b5a2c1b7ec6e0d85ead32e0213b35a71c765ac0

SHA256
e0eea0acc8a4a815ae242bfdf45b27129cbb9bdfeb1c897f58b6f5c0c771a5eb

SHA512
fbfe49f38019224e8c6327004592b52b806df6c80e3f5c66296f78a3c38b48cbba85170b832a58ad0b373599a80117226e2301bc182f8087497452e4b8de4366

Download Submit
C:\Users\Admin\AppData\Local\Temp\smg\smg.exe

Filesize
294KB

MD5
c3790fa0a84ee89f33cf7f64d21bf00f

SHA1
9b5a2c1b7ec6e0d85ead32e0213b35a71c765ac0

SHA256
e0eea0acc8a4a815ae242bfdf45b27129cbb9bdfeb1c897f58b6f5c0c771a5eb

SHA512
fbfe49f38019224e8c6327004592b52b806df6c80e3f5c66296f78a3c38b48cbba85170b832a58ad0b373599a80117226e2301bc182f8087497452e4b8de4366

Download Submit
memory/996-95-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/996-92-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/996-88-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1144-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1144-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1144-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1144-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1144-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1144-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1144-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-54-0x00000000010B0000-0x0000000001100000-memory.dmp

Filesize
320KB

Download
memory/1912-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/2040-75-0x00000000012B0000-0x0000000001300000-memory.dmp

Filesize
320KB

Download