agenttesla | c5045c31e194bd94e8979a7a8d46f5d403d98e697cd7f9335c5ab0904b613fa3

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/10/2022, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ref77013962020.exe
Size 1.1MB
Sample221026-mavbnsfda6
SHA256 c5045c31e194bd94e8979a7a8d46f5d403d98e697cd7f9335c5ab0904b613fa3
MD5 2ad81b515de54e3466eb1148cb61930d
SHA1 6aec98a97e93f5b77df047761167b90e412f753c
SHA512 2b7b873d26de0e800190d7a8c8653ca1eae3f76095aba23aea3b699671cbee4264251601ad566e1f7e2793bd19570c188eac807a0251ea7ddb44fc53c8fef9fd
SSDEEP 24576:XAOcZ9OnxbjC2Dp5VSRVhz5eBq2MNxjFJ7oHeWXL7Wf1:pVhC2vazz5nx9+7Wf1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

http://107.189.4.253/bidone/inc/fce77e8ed01c65.php

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 1 IoCs

pid	Process
4652	xjdq.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Ref77013962020.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
17	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 2256	4652	xjdq.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Ref77013962020.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2256	RegSvcs.exe
2256	RegSvcs.exe
2256	RegSvcs.exe
2256	RegSvcs.exe
2256	RegSvcs.exe
2256	RegSvcs.exe
2256	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2256	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3212	4828	Ref77013962020.exe	82
PID 4828 wrote to memory of 3212	4828	Ref77013962020.exe	82
PID 4828 wrote to memory of 3212	4828	Ref77013962020.exe	82
PID 3212 wrote to memory of 4652	3212	WScript.exe	85
PID 3212 wrote to memory of 4652	3212	WScript.exe	85
PID 3212 wrote to memory of 4652	3212	WScript.exe	85
PID 4652 wrote to memory of 2256	4652	xjdq.exe	87
PID 4652 wrote to memory of 2256	4652	xjdq.exe	87
PID 4652 wrote to memory of 2256	4652	xjdq.exe	87
PID 4652 wrote to memory of 2256	4652	xjdq.exe	87
PID 4652 wrote to memory of 2256	4652	xjdq.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Ref77013962020.exe
"C:\Users\Admin\AppData\Local\Temp\Ref77013962020.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\6_102\qispvxj.vbe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Users\Admin\AppData\Local\Temp\6_102\xjdq.exe
    "C:\Users\Admin\AppData\Local\Temp\6_102\xjdq.exe" crdkgqk.ehw
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      outlook_office_path
      outlook_win_path
      PID:2256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bossu.xxq

Path C:\Users\Admin\AppData\Local\Temp\6_102\bossu.xxq
Size 436KB
SHA256 88885eaaecffa0fac5fd97d7bd37ebf6fb721b37f60badfbc4aeb90c2a88ce2d
MD5 6c599285929ba054c999316afd7255c9
SHA1 6c1f818c90f3b8903a8d062d448fb0661786cdfa
SHA512 17010bd6e44f22c911f1654667bbb8e77b7f2658863ebb4a8a698d8bc15a5fbc65c33d076f9d568aca1b58a95cd6f01240e3d7dfb92e6e4d906d20886f5f20c4
SSDEEP 6144:1cX8iWcXq38sBBF376+SkBov6XdCEQ3Xy:1cX8bMgBh76+SkWv6NC9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

crdkgqk.ehw

Path C:\Users\Admin\AppData\Local\Temp\6_102\crdkgqk.ehw
Size 91.1MB
SHA256 7dcf1f4b3e79abae5a0d50bb67c2699df91f3e02304e67f7463d83a56e726a90
MD5 6a1679acb80ea2341456d3bf55dc6e81
SHA1 1c871097e86312ec9a5fcd490fa2fa6530c91fef
SHA512 6a645cdd94b88e39871832cf98137d803c8ed7e0b409c51b696b0512b01b078c6005737ceb5a680221bdbc5b3565a53e3c0a9055da5f919a732781d8ffaa6764
SSDEEP 98304:D0glBH1M8FkMG1FPptgPzWKxziOfM7EF+UQoZ/ZEgE/gXB6S3aFeLaJ2Sn7wfTfc:s
MD5 SHA1 SHA512 SSDEEP

Submit Download

jirmprf.bmp

Path C:\Users\Admin\AppData\Local\Temp\6_102\jirmprf.bmp
Size 43KB
SHA256 a11833fe578de3da45719f9987ea17735b19812885aedd15fba95dad3f94fcb1
MD5 55e3a6917b3e2d71dbed3667d6f31fb1
SHA1 47d61a7f50f4097691d683ef324e22a235f5fda3
SHA512 a032a5f404712a977aa1408598a780b8f0461968a26e5cda68a613a5f288a876d1605383cacc0d9b9a3e218bd452c4e47e63cd21d39c7a9a42bbef34e016229c
SSDEEP 768:Vs+mrOnNNp5/bTkWTOdfXwpQv9HlxGrD287xGOAbtHGJm87fmSxlJMDVwQNsBk:VG6L5cWKHF4P28isJqSxrmSQKBk
MD5 SHA1 SHA512 SSDEEP

Submit Download

xjdq.exe

Path C:\Users\Admin\AppData\Local\Temp\6_102\xjdq.exe
Size 1.1MB
SHA256 6334d199ec1843d738c345a2ad53c3b48b33321d54a8838491e4d62602b9a60f
MD5 8c193dbf119b3d73c22d7217e5f27192
SHA1 a37f300cacc799128fcf44bb115bcde3bdee1e6e
SHA512 ee8d1bcae8ec16b4a8fa034f1320dc79c17d7f5901b076512f386c71d2b45e6fff46d21330e4a3201d7b3319b1cffdab23a69e88998cf771aa9e99e7e0be3b0b
SSDEEP 24576:nErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a6XKl6t:n86pqeE74aB0Sdia+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

xjdq.exe

Path C:\Users\Admin\AppData\Local\Temp\6_102\xjdq.exe
Size 1.1MB
SHA256 6334d199ec1843d738c345a2ad53c3b48b33321d54a8838491e4d62602b9a60f
MD5 8c193dbf119b3d73c22d7217e5f27192
SHA1 a37f300cacc799128fcf44bb115bcde3bdee1e6e
SHA512 ee8d1bcae8ec16b4a8fa034f1320dc79c17d7f5901b076512f386c71d2b45e6fff46d21330e4a3201d7b3319b1cffdab23a69e88998cf771aa9e99e7e0be3b0b
SSDEEP 24576:nErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a6XKl6t:n86pqeE74aB0Sdia+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

qispvxj.vbe

Path C:\Users\Admin\AppData\Local\temp\6_102\qispvxj.vbe
Size 26KB
SHA256 e77668a037b6c5a26af57f942494b5879467df5f3ca406be8175b6564da669a1
MD5 6f9664a722623b1937ed7c39b11e1342
SHA1 b8de8e51b35e81ed445acfaf2b6460cf636f369e
SHA512 aae2b36f3442a9512cafef2a8e2b87249309a99fb09aa1fb4fb27c66cc8d49b2b27600a9697d3224de37a5e20c7889a544e27aad9ecd9afbb495f351135c12e0
SSDEEP 768:LDmU4JaaSy1pDmU4JaaSy1pDmU4JaaSy10DmU4JaaSy1kDmU4JaaSy1V:vrYr4rDrrr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2256-140-0x0000000000A00000-0x0000000000FE0000-memory.dmp

Download

memory/2256-142-0x0000000000A00000-0x0000000000A3C000-memory.dmp

Download

memory/2256-143-0x0000000005BE0000-0x0000000006184000-memory.dmp

Download

memory/2256-144-0x0000000005790000-0x000000000582C000-memory.dmp

Download

memory/2256-145-0x0000000006440000-0x00000000064A6000-memory.dmp

Download

memory/2256-146-0x0000000006C90000-0x0000000006CE0000-memory.dmp

Download

memory/2256-147-0x0000000006E00000-0x0000000006E92000-memory.dmp

Download

memory/2256-148-0x0000000007120000-0x000000000712A000-memory.dmp

Download