agenttesla | f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9

Analysis

max time kernel
40s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2023 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
Size

1.2MB
MD5

f686e6edd1cfdaf9e636d2e38f481a4c
SHA1

27c8dfdcc3635c5a2ce78fb5799b9e6a904cbb88
SHA256

f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9
SHA512

d79597927b92c47d89f7ecfb0dcb56ac90c960a328ff0907af7d2625a7f406c40e85a41c0428ccba0a9bec8e258d27d308660308327178a9b7c2cdbe523a7ae1
SSDEEP

24576:EZ9L+UmOVerUV8NmnedPvQMI127uvjbim1ujUO4EVzY:EZpsAVnedPs1ZuIND

Score

10^/10

agenttesla snakekeylogger keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4108-7-0x0000000000400000-0x0000000000452000-memory.dmp	family_snakekeylogger
C:\Users\Admin\AppData\Roaming\excell.exe	family_snakekeylogger
behavioral2/memory/1128-49-0x0000000000380000-0x00000000003A6000-memory.dmp	family_snakekeylogger
C:\Users\Admin\AppData\Roaming\excell.exe	family_snakekeylogger
behavioral2/memory/1128-56-0x0000000004F10000-0x0000000004F20000-memory.dmp	family_snakekeylogger
C:\Users\Admin\AppData\Roaming\excell.exe	family_snakekeylogger

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exef9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe

Executes dropped EXE 3 IoCs

Processes:

wordd.exesvchost.exeexcell.exe

pid process

2204 wordd.exe
1176 svchost.exe
1128 excell.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

76 checkip.dyndns.org
78 api.ipify.org

pid	process
2204	wordd.exe
1176	svchost.exe
1128	excell.exe

flow	ioc
76	checkip.dyndns.org
78	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe

description	pid	process	target process
PID 2612 set thread context of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

776 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

excell.exe

pid process

1128 excell.exe
1128 excell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wordd.exeexcell.exe

description pid process

Token: SeDebugPrivilege 2204 wordd.exe
Token: SeDebugPrivilege 1128 excell.exe

pid	process
776	schtasks.exe

pid	process
1128	excell.exe
1128	excell.exe

description	pid	process
Token: SeDebugPrivilege	2204	wordd.exe
Token: SeDebugPrivilege	1128	excell.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exef9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.execmd.exe

description	pid	process	target process
PID 2612 wrote to memory of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
PID 2612 wrote to memory of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
PID 2612 wrote to memory of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
PID 2612 wrote to memory of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
PID 2612 wrote to memory of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
PID 2612 wrote to memory of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
PID 2612 wrote to memory of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
PID 2612 wrote to memory of 4108	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
PID 4108 wrote to memory of 2204	4108	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	wordd.exe
PID 4108 wrote to memory of 2204	4108	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	wordd.exe
PID 4108 wrote to memory of 2204	4108	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	wordd.exe
PID 2612 wrote to memory of 1176	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	svchost.exe
PID 2612 wrote to memory of 1176	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	svchost.exe
PID 2612 wrote to memory of 1176	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	svchost.exe
PID 2612 wrote to memory of 3264	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 2612 wrote to memory of 3264	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 2612 wrote to memory of 3264	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 2612 wrote to memory of 1712	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 2612 wrote to memory of 1712	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 2612 wrote to memory of 1712	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 2612 wrote to memory of 4872	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 2612 wrote to memory of 4872	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 2612 wrote to memory of 4872	2612	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	cmd.exe
PID 4108 wrote to memory of 1128	4108	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	excell.exe
PID 4108 wrote to memory of 1128	4108	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	excell.exe
PID 4108 wrote to memory of 1128	4108	f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe	excell.exe
PID 1712 wrote to memory of 776	1712	cmd.exe	schtasks.exe
PID 1712 wrote to memory of 776	1712	cmd.exe	schtasks.exe
PID 1712 wrote to memory of 776	1712	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612

C:\Users\Admin\AppData\Local\Temp\f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4108

C:\Users\Admin\AppData\Roaming\wordd.exe
"C:\Users\Admin\AppData\Roaming\wordd.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Users\Admin\AppData\Roaming\excell.exe
"C:\Users\Admin\AppData\Roaming\excell.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Executes dropped EXE
PID:1176

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
2⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
3⤵
- Creates scheduled task(s)
PID:776

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"
2⤵
PID:3264

C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9_JC.exe.log

Filesize
520B

MD5
03febbff58da1d3318c31657d89c8542

SHA1
c9e017bd9d0a4fe533795b227c855935d86c2092

SHA256
5164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4

SHA512
3750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
621KB

MD5
ed9d91fe584d5109d4067734ac452753

SHA1
c277e57866833509d94787fc6f4d634a2714825d

SHA256
3629ed9b94ae5d0f2659d02dcb7ce258cb5c2497d5bf18f3c4fed78878fba030

SHA512
a6603acb550b897ec91b5c57b3034b8fd44ad9d675662aade0a078771b533b28e320c12c063c4ae48bfb23e8dfc85f304679458ea111db2e737043af0261bb1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
621KB

MD5
ed9d91fe584d5109d4067734ac452753

SHA1
c277e57866833509d94787fc6f4d634a2714825d

SHA256
3629ed9b94ae5d0f2659d02dcb7ce258cb5c2497d5bf18f3c4fed78878fba030

SHA512
a6603acb550b897ec91b5c57b3034b8fd44ad9d675662aade0a078771b533b28e320c12c063c4ae48bfb23e8dfc85f304679458ea111db2e737043af0261bb1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
621KB

MD5
ed9d91fe584d5109d4067734ac452753

SHA1
c277e57866833509d94787fc6f4d634a2714825d

SHA256
3629ed9b94ae5d0f2659d02dcb7ce258cb5c2497d5bf18f3c4fed78878fba030

SHA512
a6603acb550b897ec91b5c57b3034b8fd44ad9d675662aade0a078771b533b28e320c12c063c4ae48bfb23e8dfc85f304679458ea111db2e737043af0261bb1a

Download Submit
C:\Users\Admin\AppData\Roaming\excell.exe

Filesize
126KB

MD5
6da1de019796e8e63db98351f6cad74e

SHA1
da7a3211c4708c984a6423a62189730db6298060

SHA256
ff7743025a4f740a7fd346353fd5cb1fee055b20170eb11bb20b9cd88c1c5917

SHA512
199e0470b7233ea4835226a6d8bb4b7941ad276c8cbb73cff1bce287ffde9e06bdea1c96fb2069b2ca8b6448eb585e3a23054f88b8bb9fd37a4a776136526b18

Download Submit
C:\Users\Admin\AppData\Roaming\excell.exe

Filesize
126KB

MD5
6da1de019796e8e63db98351f6cad74e

SHA1
da7a3211c4708c984a6423a62189730db6298060

SHA256
ff7743025a4f740a7fd346353fd5cb1fee055b20170eb11bb20b9cd88c1c5917

SHA512
199e0470b7233ea4835226a6d8bb4b7941ad276c8cbb73cff1bce287ffde9e06bdea1c96fb2069b2ca8b6448eb585e3a23054f88b8bb9fd37a4a776136526b18

Download Submit
C:\Users\Admin\AppData\Roaming\excell.exe

Filesize
126KB

MD5
6da1de019796e8e63db98351f6cad74e

SHA1
da7a3211c4708c984a6423a62189730db6298060

SHA256
ff7743025a4f740a7fd346353fd5cb1fee055b20170eb11bb20b9cd88c1c5917

SHA512
199e0470b7233ea4835226a6d8bb4b7941ad276c8cbb73cff1bce287ffde9e06bdea1c96fb2069b2ca8b6448eb585e3a23054f88b8bb9fd37a4a776136526b18

Download Submit
C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

Filesize
496KB

MD5
d64a7c455c9ec39e43b3394f774262b1

SHA1
0d331c6b83305f085bcb2eb3cd2e275e66147eef

SHA256
4c26d34063fb9a460e130d4fa1ff7ed3cd330365f288616325ee39e4e4afe2a1

SHA512
833b305d986ed039281710dba97d30431a7b4cf00e2f130724aa9e955830c90000ce3a0369de6814f3a77e488f1a4ee64fd8955922bfe83478d47d837992ac68

Download Submit
C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

Filesize
45KB

MD5
a67bd3c1d96ea06ec353ff300027a6a6

SHA1
53da54f6714e41bdfcac3f78aa3e3023569be54f

SHA256
e6ffcb555d70a12d14a8feb071a827c88bdc20e0b5acbe313886d6d0f9ff964c

SHA512
982c62a6779b8b033845327b1c682f52a63f16e21f3e7045b4b8cb4e5e5534ef8da7cf4d0933bd4e5b27e63d9401589bca7ee2fb3f53f4cca9160fadeab00a1d

Download Submit
C:\Users\Admin\AppData\Roaming\wordd.exe

Filesize
167KB

MD5
2aa26daddfd752cc335168e0e0d88036

SHA1
e3feb57975b9fe10b0e9eaa65f729fdcd288aea4

SHA256
629e12a34d1bc3958117a33d5534f01f4d7dd02da1fa7860a69b214bbcb1f68d

SHA512
0634425cbf65d3da7942f298ce12846e0d0aea15a804479b59fddc9fed629f0224fd77b097bff3b3ad85e14d56572c330c5753296c073cdc27e46c183b95ebf4

Download Submit
C:\Users\Admin\AppData\Roaming\wordd.exe

Filesize
167KB

MD5
2aa26daddfd752cc335168e0e0d88036

SHA1
e3feb57975b9fe10b0e9eaa65f729fdcd288aea4

SHA256
629e12a34d1bc3958117a33d5534f01f4d7dd02da1fa7860a69b214bbcb1f68d

SHA512
0634425cbf65d3da7942f298ce12846e0d0aea15a804479b59fddc9fed629f0224fd77b097bff3b3ad85e14d56572c330c5753296c073cdc27e46c183b95ebf4

Download Submit
C:\Users\Admin\AppData\Roaming\wordd.exe

Filesize
167KB

MD5
2aa26daddfd752cc335168e0e0d88036

SHA1
e3feb57975b9fe10b0e9eaa65f729fdcd288aea4

SHA256
629e12a34d1bc3958117a33d5534f01f4d7dd02da1fa7860a69b214bbcb1f68d

SHA512
0634425cbf65d3da7942f298ce12846e0d0aea15a804479b59fddc9fed629f0224fd77b097bff3b3ad85e14d56572c330c5753296c073cdc27e46c183b95ebf4

Download Submit
memory/1128-56-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1128-49-0x0000000000380000-0x00000000003A6000-memory.dmp

Filesize
152KB

Download
memory/1128-53-0x0000000004C50000-0x0000000004CEC000-memory.dmp

Filesize
624KB

Download
memory/1128-52-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/1176-43-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/1176-40-0x0000000000030000-0x00000000000D2000-memory.dmp

Filesize
648KB

Download
memory/2204-54-0x0000000005210000-0x0000000005276000-memory.dmp

Filesize
408KB

Download
memory/2204-55-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/2204-50-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-47-0x00000000008E0000-0x0000000000910000-memory.dmp

Filesize
192KB

Download
memory/2612-2-0x0000000005420000-0x00000000059C4000-memory.dmp

Filesize
5.6MB

Download
memory/2612-48-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2612-1-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2612-3-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/2612-6-0x00000000050E0000-0x000000000521A000-memory.dmp

Filesize
1.2MB

Download
memory/2612-5-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/2612-0-0x0000000000340000-0x0000000000472000-memory.dmp

Filesize
1.2MB

Download
memory/2612-4-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4108-10-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4108-51-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4108-7-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4108-9-0x00000000019A0000-0x00000000019A8000-memory.dmp

Filesize
32KB

Download