agenttesla | 97510781022a321a48583288da5c06aaf7492d673e6c37c34133e04a74485503

Analysis

max time kernel
55s
max time network
120s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08/02/2023, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

statement of accounts.exe
Size

823KB
MD5

9c30d0c7e1a93c6b102c00e8921a974a
SHA1

612db60d42c16a5710b1c992d586601dc64abb91
SHA256

97510781022a321a48583288da5c06aaf7492d673e6c37c34133e04a74485503
SHA512

d3108b2ddfed7e2299f6b1fb72fe074e9ed84ccd935381d87669b88b2b6584aa1d97a62921c31bfd2cb24c648b5b1be80fe9efbc6fe67f8fff0003c9765a7bac
SSDEEP

12288:+E/hefqqG4yPaKGGSKe4chCirn8MsNspUZM25F4vnKajJ06Fy2Mxzo3:1eiqG4yPaL3d2xnspUbyrJ06F0xM

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.abaexlogistics.com
Port:
587
Username:
[email protected]
Password:
Op3r@2021!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\zOwta = "C:\\Users\\Admin\\AppData\\Roaming\\zOwta\\zOwta.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 1556	1740	statement of accounts.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1740	statement of accounts.exe
1740	statement of accounts.exe
1740	statement of accounts.exe
1740	statement of accounts.exe
1500	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	statement of accounts.exe
Token: SeDebugPrivilege	1556	RegSvcs.exe
Token: SeDebugPrivilege	1500	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1556	RegSvcs.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1500	1740	statement of accounts.exe	28
PID 1740 wrote to memory of 1500	1740	statement of accounts.exe	28
PID 1740 wrote to memory of 1500	1740	statement of accounts.exe	28
PID 1740 wrote to memory of 1500	1740	statement of accounts.exe	28
PID 1740 wrote to memory of 1184	1740	statement of accounts.exe	30
PID 1740 wrote to memory of 1184	1740	statement of accounts.exe	30
PID 1740 wrote to memory of 1184	1740	statement of accounts.exe	30
PID 1740 wrote to memory of 1184	1740	statement of accounts.exe	30
PID 1740 wrote to memory of 912	1740	statement of accounts.exe	32
PID 1740 wrote to memory of 912	1740	statement of accounts.exe	32
PID 1740 wrote to memory of 912	1740	statement of accounts.exe	32
PID 1740 wrote to memory of 912	1740	statement of accounts.exe	32
PID 1740 wrote to memory of 912	1740	statement of accounts.exe	32
PID 1740 wrote to memory of 912	1740	statement of accounts.exe	32
PID 1740 wrote to memory of 912	1740	statement of accounts.exe	32
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33
PID 1740 wrote to memory of 1556	1740	statement of accounts.exe	33

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\statement of accounts.exe
"C:\Users\Admin\AppData\Local\Temp\statement of accounts.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mWgjzqmVdb.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mWgjzqmVdb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB839.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB839.tmp

Filesize
1KB

MD5
bf2e535ceace9f2eca62c799309c226a

SHA1
db72152bb695ff6603f9cb3ef02e96202991b29a

SHA256
afe31aa87629593b8fde06f0f09f91d10a8b345bc816a6f52ab9e4bca529c42b

SHA512
b21d03a573d1162e0ac578a0c5dfd9d4df79f28d31f64cace98386ec586f1efbd8cbfb6adc6b604216747f14f39c20bdeb3a14d929b45f8fdd873ce3d6b1132d

Download Submit
memory/1500-77-0x000000006E420000-0x000000006E9CB000-memory.dmp

Filesize
5.7MB

Download
memory/1500-76-0x000000006E420000-0x000000006E9CB000-memory.dmp

Filesize
5.7MB

Download
memory/1556-72-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1556-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1556-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1556-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1556-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1556-68-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1556-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1740-58-0x0000000007EB0000-0x0000000007F1A000-memory.dmp

Filesize
424KB

Download
memory/1740-63-0x0000000008030000-0x0000000008060000-memory.dmp

Filesize
192KB

Download
memory/1740-54-0x0000000000300000-0x00000000003D4000-memory.dmp

Filesize
848KB

Download
memory/1740-57-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/1740-56-0x0000000000430000-0x0000000000444000-memory.dmp

Filesize
80KB

Download
memory/1740-55-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Filesize
8KB

Download