agenttesla | 0c73e5c8bb0945f67b5226bb5898a71cf41db95f1f1c442188167522b616d830

Analysis

max time kernel
152s
max time network
210s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA.exe
Size

575KB
MD5

4a3444b41e9b7311c8221e2e5fd279a4
SHA1

04b2b70b48c06d4b4ec50facc5b1b85bba070736
SHA256

0c73e5c8bb0945f67b5226bb5898a71cf41db95f1f1c442188167522b616d830
SHA512

ce103dd445aa6a38a975524bfe17aae3b0b4864c83b56f352680d8b4cb67bc18450ed577bd1b54176fd0c84ae19984986943aeb9d178044c28fa89c568df567a
SSDEEP

12288:cMkzrbETCltHskFgFwIyXCDo921TFji989AnMlsEpkOaj69:M76CjskFgqIyXjMBtAnasgkOaj

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot5745656562:AAEWafwrgUiORYk4Z5mN1SY726IYW3inkfw/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

SOA.exe

description pid process target process

PID 1628 set thread context of 520 1628 SOA.exe SOA.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

660 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SOA.exeSOA.exe

pid process

1628 SOA.exe
520 SOA.exe
520 SOA.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SOA.exeSOA.exe

description pid process

Token: SeDebugPrivilege 1628 SOA.exe
Token: SeDebugPrivilege 520 SOA.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 1628 set thread context of 520	1628	SOA.exe	SOA.exe

pid	process
660	schtasks.exe

pid	process
1628	SOA.exe
520	SOA.exe
520	SOA.exe

description	pid	process
Token: SeDebugPrivilege	1628	SOA.exe
Token: SeDebugPrivilege	520	SOA.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

SOA.exe

description	pid	process	target process
PID 1628 wrote to memory of 660	1628	SOA.exe	schtasks.exe
PID 1628 wrote to memory of 660	1628	SOA.exe	schtasks.exe
PID 1628 wrote to memory of 660	1628	SOA.exe	schtasks.exe
PID 1628 wrote to memory of 660	1628	SOA.exe	schtasks.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe
PID 1628 wrote to memory of 520	1628	SOA.exe	SOA.exe

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iNqCYZJg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp170B.tmp"
2⤵
- Creates scheduled task(s)
PID:660

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp170B.tmp
Filesize
1KB

MD5
b40d6c9b9e9a6ad6ad8d7e607f54e59e

SHA1
a8d5fddc2968fbdd06f9dd569ac2abb64f85037a

SHA256
ed02f64bdd8935c80e41fd742935511ccdf71a8dab6f1dbb7ed4dac4dff33f8d

SHA512
ef9ef47d39ef0b38032c3e944f38c9d4166b22bef06c2d7ded4fe3a05cb8e0a6d352f3811d33abbbd20bbb655d3315d67d4a4264d39fcb22d7a790417d4838ee

Download Submit
memory/520-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-67-0x0000000000437BCE-mapping.dmp

Download
memory/520-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/660-59-0x0000000000000000-mapping.dmp

Download
memory/1628-54-0x0000000000D20000-0x0000000000DB6000-memory.dmp

Filesize
600KB

Download
memory/1628-55-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1628-56-0x00000000006E0000-0x00000000006F2000-memory.dmp

Filesize
72KB

Download
memory/1628-58-0x0000000000C20000-0x0000000000C5C000-memory.dmp

Filesize
240KB

Download
memory/1628-57-0x00000000055C0000-0x0000000005640000-memory.dmp

Filesize
512KB

Download