agenttesla | bd46a723d17048369ac18ff1a2ec0d0f54a8a4a3c5e23d56a53e014a02d1c42e

Analysis

max time kernel
58s
max time network
121s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/06/2023, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA.exe
Size 725KB
Sample230607-lfb7lsaa5w
SHA256 bd46a723d17048369ac18ff1a2ec0d0f54a8a4a3c5e23d56a53e014a02d1c42e
MD5 81f81fd0f05f3c17d048594594eff66e
SHA1 1ed6c21a82e8867702411a99c2ce9f090696cc63
SHA512 fa011662aebe0fcf60cce6c4252ddfcf55d72eac79f46c2c9a0788aa53983264cca8e9b225569c55c6985cfc0865acfe2dfbeeb53e4a2c1feb0024e0fc5ca3d4
SSDEEP 12288:CE+J/M+Jhewx/NscEQ+vgXK1HsaPkIaUiIfulwZ13L/YNEZSJ+p+HZBxQcAjeimU:I/thewlqB6pXIdiIfwUd7YR+cHx4n7Eo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot6061522440:AAEyUaroz36ZNerlwooUfFQ5F1Y3NwqSJOs/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfftgT = "C:\\Users\\Admin\\AppData\\Roaming\\zfftgT\\zfftgT.exe"	SOA.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 1452	1152	SOA.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1152	SOA.exe
1152	SOA.exe
1152	SOA.exe
1152	SOA.exe
524	powershell.exe
556	powershell.exe
1452	SOA.exe
1452	SOA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	SOA.exe
Token: SeDebugPrivilege	1452	SOA.exe
Token: SeDebugPrivilege	524	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 524	1152	SOA.exe	28
PID 1152 wrote to memory of 524	1152	SOA.exe	28
PID 1152 wrote to memory of 524	1152	SOA.exe	28
PID 1152 wrote to memory of 524	1152	SOA.exe	28
PID 1152 wrote to memory of 556	1152	SOA.exe	30
PID 1152 wrote to memory of 556	1152	SOA.exe	30
PID 1152 wrote to memory of 556	1152	SOA.exe	30
PID 1152 wrote to memory of 556	1152	SOA.exe	30
PID 1152 wrote to memory of 684	1152	SOA.exe	32
PID 1152 wrote to memory of 684	1152	SOA.exe	32
PID 1152 wrote to memory of 684	1152	SOA.exe	32
PID 1152 wrote to memory of 684	1152	SOA.exe	32
PID 1152 wrote to memory of 1452	1152	SOA.exe	34
PID 1152 wrote to memory of 1452	1152	SOA.exe	34
PID 1152 wrote to memory of 1452	1152	SOA.exe	34
PID 1152 wrote to memory of 1452	1152	SOA.exe	34
PID 1152 wrote to memory of 1452	1152	SOA.exe	34
PID 1152 wrote to memory of 1452	1152	SOA.exe	34
PID 1152 wrote to memory of 1452	1152	SOA.exe	34
PID 1152 wrote to memory of 1452	1152	SOA.exe	34
PID 1152 wrote to memory of 1452	1152	SOA.exe	34

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BHyFkSG.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BHyFkSG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD25D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:684
- C:\Users\Admin\AppData\Local\Temp\SOA.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpD25D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD25D.tmp
Size 1KB
SHA256 a0b568077f4b375e2b19212a873ccdcf430bd6f4ac54782c6f91d4f29102a0a5
MD5 ccfb136a604162f9d3b033d482e280fa
SHA1 245408f9aabc80a6ab5d89f9fae0f792a36ebd05
SHA512 f36c59dd73fff89f90f00f521d2479dcaa11af6caa2ce4247e90f4021a8087f9836dd1720d6f580165634e11751a4232b041ce834e5ee1263c42e8613f77a668
MD5 SHA1 SHA512

Submit Download

J1W1FZTF0T74P0001ZUQ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J1W1FZTF0T74P0001ZUQ.temp
Size 7KB
SHA256 51e79d41b3dd2f950ae83899b2aff0d7151ad4a88d53a09596da4dfb5f41598b
MD5 2d1c51685135370edec6012ce30c97bd
SHA1 42d4b8939853a6884fdbc25fd3107bddea19d73a
SHA512 3584c6f7183650b285f8e8dafbe51170845e962250dafd312f161a8bb8d1d64e3679a34561a7315afb3cd7cba2f7cb493cb3bc91554a2cc8bf160747378d394b
SSDEEP 96:QlKCJM8slnqvsqvJCwotHvMlKCJM8slnqvsEHyqvJCworbHvm5FkUlQHUIf7o56w:kLYlUotwLYlAHnorb+hlRIf7oQlKZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 51e79d41b3dd2f950ae83899b2aff0d7151ad4a88d53a09596da4dfb5f41598b
MD5 2d1c51685135370edec6012ce30c97bd
SHA1 42d4b8939853a6884fdbc25fd3107bddea19d73a
SHA512 3584c6f7183650b285f8e8dafbe51170845e962250dafd312f161a8bb8d1d64e3679a34561a7315afb3cd7cba2f7cb493cb3bc91554a2cc8bf160747378d394b
SSDEEP 96:QlKCJM8slnqvsqvJCwotHvMlKCJM8slnqvsEHyqvJCworbHvm5FkUlQHUIf7o56w:kLYlUotwLYlAHnorb+hlRIf7oQlKZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/524-84-0x00000000026B0000-0x00000000026F0000-memory.dmp

Download

memory/556-87-0x00000000025D0000-0x0000000002610000-memory.dmp

Download

memory/556-85-0x00000000025D0000-0x0000000002610000-memory.dmp

Download

memory/556-83-0x00000000025D0000-0x0000000002610000-memory.dmp

Download

memory/1152-57-0x0000000000650000-0x0000000000690000-memory.dmp

Download

memory/1152-59-0x0000000005B80000-0x0000000005BEC000-memory.dmp

Download

memory/1152-72-0x000000000A570000-0x000000000A5A4000-memory.dmp

Download

memory/1152-54-0x00000000011E0000-0x000000000129C000-memory.dmp

Download

memory/1152-58-0x0000000000460000-0x000000000046C000-memory.dmp

Download

memory/1152-56-0x0000000000450000-0x0000000000462000-memory.dmp

Download

memory/1152-55-0x0000000000650000-0x0000000000690000-memory.dmp

Download

memory/1452-73-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1452-78-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1452-80-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1452-82-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1452-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1452-76-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1452-86-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Download

memory/1452-75-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1452-74-0x0000000000400000-0x0000000000430000-memory.dmp

Download