agenttesla | 02c82d7b7be7553259a42370f46fb351f5c65fe771c1d6616fefa3f19fd542dc | Triage

Analysis

max time kernel
62s
max time network
59s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/06/2023, 08:17 UTC

Sharing

Report Analysis Logs

General

Target

804152064.exe
Size

723KB
MD5

331bc06d67e4078e0779a9a0a5d355b5
SHA1

475924a69dee5e4a4ab1a66c944068fa2111db68
SHA256

ad641230d3be8895193642d333ed88e1d6e94c209dfcb6c1932cd6a7f324a82f
SHA512

8e30912ab46b825292955ad70f816a8a12171692272af563181630a4ec0e24de2dbb240c8cfbf666e6233fc9c58858d88de53164dde82a804066c842501c8fee
SSDEEP

12288:sk+J/M+Jhewx/NscEQ+vgXK1HsaPbntTjlFhush1nPTs8HlaxYvR1toDvll2Hvk/:sl/thewlqB6pGjlfusbrs8UYvREblivu

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
triihope931@gmail.com
Password:
iebtzpacgzyullvo
Email To:
triihope931@gmail.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

Email Collection

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\aCcAwFD = "C:\\Users\\Admin\\AppData\\Roaming\\aCcAwFD\\aCcAwFD.exe"	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1420	1732	804152064.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1732	804152064.exe
1732	804152064.exe
1732	804152064.exe
1732	804152064.exe
1732	804152064.exe
1732	804152064.exe
1732	804152064.exe
1732	804152064.exe
1732	804152064.exe
1732	804152064.exe
268	powershell.exe
1420	MSBuild.exe
1420	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	804152064.exe
Token: SeDebugPrivilege	1420	MSBuild.exe
Token: SeDebugPrivilege	268	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 268	1732	804152064.exe	28
PID 1732 wrote to memory of 268	1732	804152064.exe	28
PID 1732 wrote to memory of 268	1732	804152064.exe	28
PID 1732 wrote to memory of 268	1732	804152064.exe	28
PID 1732 wrote to memory of 648	1732	804152064.exe	30
PID 1732 wrote to memory of 648	1732	804152064.exe	30
PID 1732 wrote to memory of 648	1732	804152064.exe	30
PID 1732 wrote to memory of 648	1732	804152064.exe	30
PID 1732 wrote to memory of 828	1732	804152064.exe	32
PID 1732 wrote to memory of 828	1732	804152064.exe	32
PID 1732 wrote to memory of 828	1732	804152064.exe	32
PID 1732 wrote to memory of 828	1732	804152064.exe	32
PID 1732 wrote to memory of 1268	1732	804152064.exe	33
PID 1732 wrote to memory of 1268	1732	804152064.exe	33
PID 1732 wrote to memory of 1268	1732	804152064.exe	33
PID 1732 wrote to memory of 1268	1732	804152064.exe	33
PID 1732 wrote to memory of 1516	1732	804152064.exe	34
PID 1732 wrote to memory of 1516	1732	804152064.exe	34
PID 1732 wrote to memory of 1516	1732	804152064.exe	34
PID 1732 wrote to memory of 1516	1732	804152064.exe	34
PID 1732 wrote to memory of 736	1732	804152064.exe	35
PID 1732 wrote to memory of 736	1732	804152064.exe	35
PID 1732 wrote to memory of 736	1732	804152064.exe	35
PID 1732 wrote to memory of 736	1732	804152064.exe	35
PID 1732 wrote to memory of 1420	1732	804152064.exe	36
PID 1732 wrote to memory of 1420	1732	804152064.exe	36
PID 1732 wrote to memory of 1420	1732	804152064.exe	36
PID 1732 wrote to memory of 1420	1732	804152064.exe	36
PID 1732 wrote to memory of 1420	1732	804152064.exe	36
PID 1732 wrote to memory of 1420	1732	804152064.exe	36
PID 1732 wrote to memory of 1420	1732	804152064.exe	36
PID 1732 wrote to memory of 1420	1732	804152064.exe	36
PID 1732 wrote to memory of 1420	1732	804152064.exe	36

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\804152064.exe
"C:\Users\Admin\AppData\Local\Temp\804152064.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yZRXCHBD.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:268
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yZRXCHBD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAF15.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1420

Network

DNS

api.ipify.org

MSBuild.exe

Remote address:

8.8.8.8:53

Request

api.ipify.org

IN A

Response

api.ipify.org

IN CNAME

api4.ipify.org

api4.ipify.org

IN A

104.237.62.211

api4.ipify.org

IN A

64.185.227.155

api4.ipify.org

IN A

173.231.16.76

104.237.62.211:443

api.ipify.org

MSBuild.exe

104 B
2

8.8.8.8:53

api.ipify.org

dns

MSBuild.exe

59 B
126 B
1
1

DNS Request

api.ipify.org

DNS Response

104.237.62.211

64.185.227.155

173.231.16.76

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAF15.tmp

Filesize
1KB

MD5
1e2b98360a88b453a9dfca9e7456e75c

SHA1
41a28d863b3c4370e49ebb3cb8f3d02768248c83

SHA256
cfce83b59d5b375cc9083c5f85ec7461010f558a61fa190d35a1459d9df6d76a

SHA512
2fcf76c2ea190f4a91f630ea4e626b30aa67a606fbc24e26d56cfd0f24e2988b32a9b9b8ecea8c63e5875c28cad20470971f9899484ef181c2223d21911740c9

Download Submit
memory/1420-72-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1420-75-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1420-80-0x0000000002230000-0x0000000002270000-memory.dmp

Filesize
256KB

Download
memory/1420-78-0x0000000002230000-0x0000000002270000-memory.dmp

Filesize
256KB

Download
memory/1420-77-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1420-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1420-73-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1420-68-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1420-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1420-70-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1732-56-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/1732-54-0x00000000008B0000-0x000000000096A000-memory.dmp

Filesize
744KB

Download
memory/1732-65-0x00000000020D0000-0x0000000002102000-memory.dmp

Filesize
200KB

Download
memory/1732-55-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/1732-59-0x0000000005F80000-0x0000000005FEA000-memory.dmp

Filesize
424KB

Download
memory/1732-58-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/1732-57-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download