agenttesla | bc16d3bbd177cb05ba8951e898d56c2c1f8969274579e9f33e3b0c76b8ff9c7a

Resubmissions

22/03/2023, 07:33

230322-jdt9asfe42 10

22/03/2023, 07:02

230322-htsjzahc8t 10

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/03/2023, 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA 9206174.exe
Size

457KB
MD5

aab0efeffaee8ccddd956b602002217d
SHA1

7e926e8ffc86deb65dfacd5c698134ca42dc78ac
SHA256

00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49
SHA512

968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489
SSDEEP

12288:LS9gOrY+/Vtrc3x8yLcJOzgMZbYZ0OY+zVGziaAUPrC:LS95TdIKyI8zgM+0gVsPAUP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flash-tours.gr
Port:
587
Username:
[email protected]
Password:
abcdef7890!#%&(
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 1 IoCs

pid	Process
1112	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
436	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	SOA 9206174.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 888	1112	svchost.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	888	WerFault.exe	38

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1612	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
580	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1716	SOA 9206174.exe
1112	svchost.exe
1112	svchost.exe
1112	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	SOA 9206174.exe
Token: SeDebugPrivilege	1112	svchost.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2044	1716	SOA 9206174.exe	28
PID 1716 wrote to memory of 2044	1716	SOA 9206174.exe	28
PID 1716 wrote to memory of 2044	1716	SOA 9206174.exe	28
PID 1716 wrote to memory of 436	1716	SOA 9206174.exe	30
PID 1716 wrote to memory of 436	1716	SOA 9206174.exe	30
PID 1716 wrote to memory of 436	1716	SOA 9206174.exe	30
PID 436 wrote to memory of 580	436	cmd.exe	32
PID 436 wrote to memory of 580	436	cmd.exe	32
PID 436 wrote to memory of 580	436	cmd.exe	32
PID 2044 wrote to memory of 1612	2044	cmd.exe	33
PID 2044 wrote to memory of 1612	2044	cmd.exe	33
PID 2044 wrote to memory of 1612	2044	cmd.exe	33
PID 436 wrote to memory of 1112	436	cmd.exe	34
PID 436 wrote to memory of 1112	436	cmd.exe	34
PID 436 wrote to memory of 1112	436	cmd.exe	34
PID 1112 wrote to memory of 1412	1112	svchost.exe	35
PID 1112 wrote to memory of 1412	1112	svchost.exe	35
PID 1112 wrote to memory of 1412	1112	svchost.exe	35
PID 1112 wrote to memory of 316	1112	svchost.exe	36
PID 1112 wrote to memory of 316	1112	svchost.exe	36
PID 1112 wrote to memory of 316	1112	svchost.exe	36
PID 1112 wrote to memory of 1876	1112	svchost.exe	37
PID 1112 wrote to memory of 1876	1112	svchost.exe	37
PID 1112 wrote to memory of 1876	1112	svchost.exe	37
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 1112 wrote to memory of 888	1112	svchost.exe	38
PID 888 wrote to memory of 1536	888	SetupUtility.exe	39
PID 888 wrote to memory of 1536	888	SetupUtility.exe	39
PID 888 wrote to memory of 1536	888	SetupUtility.exe	39
PID 888 wrote to memory of 1536	888	SetupUtility.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SOA 9206174.exe
"C:\Users\Admin\AppData\Local\Temp\SOA 9206174.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1612
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1EB8.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:580
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
      4⤵
      PID:1412
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
      4⤵
      PID:316
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
      4⤵
      PID:1876
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 168
        5⤵
        Program crash
        
        PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1EB8.tmp.bat

Filesize
151B

MD5
1d68e14801c6e1fc610623a015d78c8c

SHA1
949bb1631b089b2a98439c6df4177b6b3e2deaa3

SHA256
5fad200e965db0a21bbac2a41552550e929ec8e332065af67f51dc0b7e988626

SHA512
f9aad7d19619bab561262ec17f41129a520ee911352caf803ecbaff1e98b6bef9b62475b8af6113b67ba73fe7cb209c19269be189dfb199cc6cfa36e5db1c58a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1EB8.tmp.bat

Filesize
151B

MD5
1d68e14801c6e1fc610623a015d78c8c

SHA1
949bb1631b089b2a98439c6df4177b6b3e2deaa3

SHA256
5fad200e965db0a21bbac2a41552550e929ec8e332065af67f51dc0b7e988626

SHA512
f9aad7d19619bab561262ec17f41129a520ee911352caf803ecbaff1e98b6bef9b62475b8af6113b67ba73fe7cb209c19269be189dfb199cc6cfa36e5db1c58a

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
457KB

MD5
aab0efeffaee8ccddd956b602002217d

SHA1
7e926e8ffc86deb65dfacd5c698134ca42dc78ac

SHA256
00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49

SHA512
968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
457KB

MD5
aab0efeffaee8ccddd956b602002217d

SHA1
7e926e8ffc86deb65dfacd5c698134ca42dc78ac

SHA256
00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49

SHA512
968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
457KB

MD5
aab0efeffaee8ccddd956b602002217d

SHA1
7e926e8ffc86deb65dfacd5c698134ca42dc78ac

SHA256
00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49

SHA512
968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489

Download Submit
memory/888-72-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1112-70-0x0000000000250000-0x00000000002C6000-memory.dmp

Filesize
472KB

Download
memory/1112-71-0x000000001AC40000-0x000000001ACC0000-memory.dmp

Filesize
512KB

Download
memory/1716-54-0x00000000011B0000-0x0000000001226000-memory.dmp

Filesize
472KB

Download
memory/1716-55-0x0000000001130000-0x00000000011A0000-memory.dmp

Filesize
448KB

Download
memory/1716-56-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download