agenttesla | bc16d3bbd177cb05ba8951e898d56c2c1f8969274579e9f33e3b0c76b8ff9c7a

Resubmissions

22/03/2023, 07:33

230322-jdt9asfe42 10

22/03/2023, 07:02

230322-htsjzahc8t 10

Analysis

max time kernel
30s
max time network
146s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/03/2023, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA 9206174.exe
Size

457KB
MD5

aab0efeffaee8ccddd956b602002217d
SHA1

7e926e8ffc86deb65dfacd5c698134ca42dc78ac
SHA256

00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49
SHA512

968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489
SSDEEP

12288:LS9gOrY+/Vtrc3x8yLcJOzgMZbYZ0OY+zVGziaAUPrC:LS95TdIKyI8zgM+0gVsPAUP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flash-tours.gr
Port:
587
Username:
[email protected]
Password:
abcdef7890!#%&(
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 1 IoCs

pid	Process
580	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	cmd.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	SOA 9206174.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\My App = "C:\\Users\\Admin\\AppData\\Roaming\\My App\\My App.exe"	jsc.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 744	580	svchost.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
320	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
660	timeout.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
592	SOA 9206174.exe
580	svchost.exe
580	svchost.exe
580	svchost.exe
580	svchost.exe
580	svchost.exe
580	svchost.exe
580	svchost.exe
580	svchost.exe
580	svchost.exe
580	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	SOA 9206174.exe
Token: SeDebugPrivilege	580	svchost.exe
Token: SeDebugPrivilege	744	jsc.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 1692	592	SOA 9206174.exe	26
PID 592 wrote to memory of 1692	592	SOA 9206174.exe	26
PID 592 wrote to memory of 1692	592	SOA 9206174.exe	26
PID 592 wrote to memory of 1688	592	SOA 9206174.exe	28
PID 592 wrote to memory of 1688	592	SOA 9206174.exe	28
PID 592 wrote to memory of 1688	592	SOA 9206174.exe	28
PID 1688 wrote to memory of 660	1688	cmd.exe	30
PID 1688 wrote to memory of 660	1688	cmd.exe	30
PID 1688 wrote to memory of 660	1688	cmd.exe	30
PID 1692 wrote to memory of 320	1692	cmd.exe	31
PID 1692 wrote to memory of 320	1692	cmd.exe	31
PID 1692 wrote to memory of 320	1692	cmd.exe	31
PID 1688 wrote to memory of 580	1688	cmd.exe	32
PID 1688 wrote to memory of 580	1688	cmd.exe	32
PID 1688 wrote to memory of 580	1688	cmd.exe	32
PID 580 wrote to memory of 1760	580	svchost.exe	33
PID 580 wrote to memory of 1760	580	svchost.exe	33
PID 580 wrote to memory of 1760	580	svchost.exe	33
PID 580 wrote to memory of 1812	580	svchost.exe	34
PID 580 wrote to memory of 1812	580	svchost.exe	34
PID 580 wrote to memory of 1812	580	svchost.exe	34
PID 580 wrote to memory of 996	580	svchost.exe	35
PID 580 wrote to memory of 996	580	svchost.exe	35
PID 580 wrote to memory of 996	580	svchost.exe	35
PID 580 wrote to memory of 300	580	svchost.exe	36
PID 580 wrote to memory of 300	580	svchost.exe	36
PID 580 wrote to memory of 300	580	svchost.exe	36
PID 580 wrote to memory of 1396	580	svchost.exe	37
PID 580 wrote to memory of 1396	580	svchost.exe	37
PID 580 wrote to memory of 1396	580	svchost.exe	37
PID 580 wrote to memory of 568	580	svchost.exe	38
PID 580 wrote to memory of 568	580	svchost.exe	38
PID 580 wrote to memory of 568	580	svchost.exe	38
PID 580 wrote to memory of 860	580	svchost.exe	39
PID 580 wrote to memory of 860	580	svchost.exe	39
PID 580 wrote to memory of 860	580	svchost.exe	39
PID 580 wrote to memory of 1684	580	svchost.exe	40
PID 580 wrote to memory of 1684	580	svchost.exe	40
PID 580 wrote to memory of 1684	580	svchost.exe	40
PID 580 wrote to memory of 740	580	svchost.exe	41
PID 580 wrote to memory of 740	580	svchost.exe	41
PID 580 wrote to memory of 740	580	svchost.exe	41
PID 580 wrote to memory of 1508	580	svchost.exe	42
PID 580 wrote to memory of 1508	580	svchost.exe	42
PID 580 wrote to memory of 1508	580	svchost.exe	42
PID 580 wrote to memory of 744	580	svchost.exe	43
PID 580 wrote to memory of 744	580	svchost.exe	43
PID 580 wrote to memory of 744	580	svchost.exe	43
PID 580 wrote to memory of 744	580	svchost.exe	43
PID 580 wrote to memory of 744	580	svchost.exe	43
PID 580 wrote to memory of 744	580	svchost.exe	43
PID 580 wrote to memory of 744	580	svchost.exe	43
PID 580 wrote to memory of 744	580	svchost.exe	43
PID 580 wrote to memory of 744	580	svchost.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\SOA 9206174.exe
"C:\Users\Admin\AppData\Local\Temp\SOA 9206174.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:320
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8057.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:660
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:580
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
      4⤵
      PID:1760
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:1812
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
      4⤵
      PID:996
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
      4⤵
      PID:300
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:1396
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
      4⤵
      PID:568
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
      4⤵
      PID:860
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
      4⤵
      PID:1684
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:740
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
      4⤵
      PID:1508
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8057.tmp.bat

Filesize
151B

MD5
64f1910b88698a244b69bb21f6910b99

SHA1
45ee2b3055cca7c447b0afd6c32d71e800cb18c3

SHA256
e0ea33b4f9dea40fbbf64e04fa1c374a2dfea0684ba05e5e0c7e76165c9c1cbc

SHA512
dfaa99e654a17bd7d57db2c37caec4ac256dd21de4f32c5c7a462c97e37697365bbc57d3192a589cfb4a943a507e09cd45645b2f5bb0223d821ef89b9cf30e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8057.tmp.bat

Filesize
151B

MD5
64f1910b88698a244b69bb21f6910b99

SHA1
45ee2b3055cca7c447b0afd6c32d71e800cb18c3

SHA256
e0ea33b4f9dea40fbbf64e04fa1c374a2dfea0684ba05e5e0c7e76165c9c1cbc

SHA512
dfaa99e654a17bd7d57db2c37caec4ac256dd21de4f32c5c7a462c97e37697365bbc57d3192a589cfb4a943a507e09cd45645b2f5bb0223d821ef89b9cf30e28

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
457KB

MD5
aab0efeffaee8ccddd956b602002217d

SHA1
7e926e8ffc86deb65dfacd5c698134ca42dc78ac

SHA256
00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49

SHA512
968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
457KB

MD5
aab0efeffaee8ccddd956b602002217d

SHA1
7e926e8ffc86deb65dfacd5c698134ca42dc78ac

SHA256
00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49

SHA512
968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
457KB

MD5
aab0efeffaee8ccddd956b602002217d

SHA1
7e926e8ffc86deb65dfacd5c698134ca42dc78ac

SHA256
00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49

SHA512
968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489

Download Submit
memory/580-70-0x0000000000F80000-0x0000000000FF6000-memory.dmp

Filesize
472KB

Download
memory/580-71-0x0000000000E40000-0x0000000000EC0000-memory.dmp

Filesize
512KB

Download
memory/592-56-0x0000000000380000-0x00000000003F0000-memory.dmp

Filesize
448KB

Download
memory/592-55-0x000000001B450000-0x000000001B4D0000-memory.dmp

Filesize
512KB

Download
memory/592-54-0x0000000000DE0000-0x0000000000E56000-memory.dmp

Filesize
472KB

Download
memory/744-72-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/744-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/744-76-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/744-77-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

Filesize
256KB

Download
memory/744-96-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

Filesize
256KB

Download