agenttesla | 6145c8fc813d508340218c8738c6002d2a8e5e6d4b0795c52acfdd2f48e09228

Analysis

max time kernel
138s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/03/2023, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TNT EXPRESS CONSIGNMENT.exe
Size 323KB
Sample230309-kggcaaad21
SHA256 6145c8fc813d508340218c8738c6002d2a8e5e6d4b0795c52acfdd2f48e09228
MD5 ba950a05b7440eda80ab5de407bd54f5
SHA1 b0242113dc571a03dc63f79581296c1e944612e4
SHA512 6ab1236badf37ebbc7b6df9f72efd6c8354c2d7e63d81b2df1c02f39520e918ba69f41ed2815e4a33b1c642778c7226f84cc1e9ee3cf733957f344fad15b4dc6
SSDEEP 6144:TYa635IM0RdEqpQScQMTn33m/CHPUQInfvfXnIbx0QU31BRW0WmpjAx/8:TYl5IM07TcQ8ECMPyDe1+3mpj48
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 3 IoCs

resource	yara_rule
behavioral1/memory/436-69-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/436-73-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/436-74-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

pid	Process
1632	oalnoej.exe
436	oalnoej.exe

Loads dropped DLL 5 IoCs

pid	Process
1772	TNT EXPRESS CONSIGNMENT.exe
1772	TNT EXPRESS CONSIGNMENT.exe
1632	oalnoej.exe
888	dw20.exe
888	dw20.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 436	1632	oalnoej.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	oalnoej.exe
436	oalnoej.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
888	dw20.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1632	oalnoej.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	oalnoej.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1632	1772	TNT EXPRESS CONSIGNMENT.exe	28
PID 1772 wrote to memory of 1632	1772	TNT EXPRESS CONSIGNMENT.exe	28
PID 1772 wrote to memory of 1632	1772	TNT EXPRESS CONSIGNMENT.exe	28
PID 1772 wrote to memory of 1632	1772	TNT EXPRESS CONSIGNMENT.exe	28
PID 1632 wrote to memory of 436	1632	oalnoej.exe	29
PID 1632 wrote to memory of 436	1632	oalnoej.exe	29
PID 1632 wrote to memory of 436	1632	oalnoej.exe	29
PID 1632 wrote to memory of 436	1632	oalnoej.exe	29
PID 1632 wrote to memory of 436	1632	oalnoej.exe	29
PID 436 wrote to memory of 888	436	oalnoej.exe	30
PID 436 wrote to memory of 888	436	oalnoej.exe	30
PID 436 wrote to memory of 888	436	oalnoej.exe	30
PID 436 wrote to memory of 888	436	oalnoej.exe	30

C:\Users\Admin\AppData\Local\Temp\TNT EXPRESS CONSIGNMENT.exe
"C:\Users\Admin\AppData\Local\Temp\TNT EXPRESS CONSIGNMENT.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
  "C:\Users\Admin\AppData\Local\Temp\oalnoej.exe" C:\Users\Admin\AppData\Local\Temp\vbypskzzm.t
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
    "C:\Users\Admin\AppData\Local\Temp\oalnoej.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 520
      4⤵
      Loads dropped DLL
      Suspicious behavior: GetForegroundWindowSpam
      PID:888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oalnoej.exe

Path C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

uluuzv.qwq

Path C:\Users\Admin\AppData\Local\Temp\uluuzv.qwq
Size 314KB
SHA256 13aa92dd7fe066f07b60550741a82dfd477843d3126db8e9b1bb701adcb0391f
MD5 45fc83dc1926d584f12f2967b68c21c3
SHA1 7d5532026f4512ebd5483b65603e1692b6494b79
SHA512 67c3f48d3d56bf898ff1458ed9a699d6ca60da3c48a47629f1c7f3faf159b35c15c030e845d458b0c2c4136bbde8564cd81ce4a727a031151e0d3c9b38339381
SSDEEP 6144:p6HzQnQPYrK9wZZ8ysvN9ueQ6R3TcHvt2Cn7jdCGb7LzapAhCjP6RNrG:cTlYWqfkQOSACnfdCGnjCz2NG
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbypskzzm.t

Path C:\Users\Admin\AppData\Local\Temp\vbypskzzm.t
Size 5KB
SHA256 f0568d9a0b3e55447aa7f4e7d542ce3f991d7f68c16040056949856f2a75ee2f
MD5 1cb41ebf743002419c569cca4bde38bb
SHA1 e9c159bb3ed610c5add654c10a13690d8adb6201
SHA512 dab616e888aa3859ff1dcadcaedba7882d97338768d31e1b9f84101854fa1e849137010137343879a7ec4463e7088ef40d1f33a6cb4b4946262fd3cd07bc93e8
SSDEEP 96:Farc6oY0g/DrYupk2XO5oSwYZn1V9xfL8uYxJU15FK9OHPfrHCmbvrfjXC:FarcREhhX1S9XrVLtuJU15PJLrLXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path \Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path \Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path \Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path \Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path \Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-69-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/436-75-0x00000000020E0000-0x0000000002120000-memory.dmp

Download

memory/436-76-0x00000000020E0000-0x0000000002120000-memory.dmp

Download

memory/436-74-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/436-73-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/888-79-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download