agenttesla | a2776d5990fb7f9437f03e0c02403b76afac031b9c03ae27dc6bbb1fb899b0ec

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SWIFT COPY.pdf.exe
Size

519KB
MD5

9fcf21603085f607c7a635ca03d8b91c
SHA1

ea113d8f9332eb31330d13d1b4c2e2a165f5dccc
SHA256

0b675485123aef301b8f33a5ebca2b1dfb12c7bffcdc7331dc16615c9d6b0495
SHA512

fc2096b88af2dcea1c87d276b3b07d2cbf44e4508f33d6513802ead833c950a29f4ada486c840b0b1a9ae2418c14bf931cc6a2aa213e6fb2ca9f34981c5d01c6
SSDEEP

12288:un2yaWZp7RBGDaSV0lO3jJukZW2WaKYEDbA18WFDtlu1HCu:4fBGOSV0lOVAtYE/+BDtl

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.expertsconsultgh.co
Port:
587
Username:
[email protected]
Password:
Oppong.2012
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	SWIFT COPY.pdf.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	api.ipify.org
41	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2948 set thread context of 1672	2948	SWIFT COPY.pdf.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2948	SWIFT COPY.pdf.exe
2948	SWIFT COPY.pdf.exe
5092	powershell.exe
4688	powershell.exe
2948	SWIFT COPY.pdf.exe
5092	powershell.exe
4688	powershell.exe
1672	RegSvcs.exe
1672	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	SWIFT COPY.pdf.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	1672	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 5092	2948	SWIFT COPY.pdf.exe	92
PID 2948 wrote to memory of 5092	2948	SWIFT COPY.pdf.exe	92
PID 2948 wrote to memory of 5092	2948	SWIFT COPY.pdf.exe	92
PID 2948 wrote to memory of 4688	2948	SWIFT COPY.pdf.exe	94
PID 2948 wrote to memory of 4688	2948	SWIFT COPY.pdf.exe	94
PID 2948 wrote to memory of 4688	2948	SWIFT COPY.pdf.exe	94
PID 2948 wrote to memory of 4848	2948	SWIFT COPY.pdf.exe	96
PID 2948 wrote to memory of 4848	2948	SWIFT COPY.pdf.exe	96
PID 2948 wrote to memory of 4848	2948	SWIFT COPY.pdf.exe	96
PID 2948 wrote to memory of 1672	2948	SWIFT COPY.pdf.exe	98
PID 2948 wrote to memory of 1672	2948	SWIFT COPY.pdf.exe	98
PID 2948 wrote to memory of 1672	2948	SWIFT COPY.pdf.exe	98
PID 2948 wrote to memory of 1672	2948	SWIFT COPY.pdf.exe	98
PID 2948 wrote to memory of 1672	2948	SWIFT COPY.pdf.exe	98
PID 2948 wrote to memory of 1672	2948	SWIFT COPY.pdf.exe	98
PID 2948 wrote to memory of 1672	2948	SWIFT COPY.pdf.exe	98
PID 2948 wrote to memory of 1672	2948	SWIFT COPY.pdf.exe	98

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JSaNwejETrW.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JSaNwejETrW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp507C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
80f7fd2fbdb8451ee001bb942eb066a4

SHA1
dbab2b9ea9b1e6ee7275f2986255225e37c937fe

SHA256
b692876cc0d2d0b33a7967d6434152399fc2f15d4163c80cf1bf7c78f6b9e9d7

SHA512
23e1edc8cb112d85f0463273194b2e46755416d5d1016c5ff3819f6d1c3b93117a4b77525d7f290f2fee1890b53f72181ab0924887909415b4cbed3ce55b0158

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_frrxjmai.agx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp507C.tmp

Filesize
1KB

MD5
41b8a29b3a9cd283587e62cefb00007c

SHA1
d4f5a2394ae90d67f53a65137e520c20d23ddf0c

SHA256
6bd56b88e655b49607adc1cc4d5fd9dd60e102969d841dac81663d99cf017bb6

SHA512
d575b4b4d424337b3ff8d52dcdc182c78e9230d47ab72464c8077f62f4018a92c7006523986eff64076f555d27057a411fefdfbded61c5b03e20233594839716

Download Submit
memory/1672-100-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/1672-89-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/1672-49-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/1672-50-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/1672-26-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1672-95-0x00000000065C0000-0x0000000006610000-memory.dmp

Filesize
320KB

Download
memory/1672-98-0x00000000067E0000-0x00000000069A2000-memory.dmp

Filesize
1.8MB

Download
memory/2948-9-0x0000000005B50000-0x0000000005B5A000-memory.dmp

Filesize
40KB

Download
memory/2948-4-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

Filesize
64KB

Download
memory/2948-10-0x00000000069A0000-0x0000000006A0A000-memory.dmp

Filesize
424KB

Download
memory/2948-0-0x0000000000F60000-0x0000000000FE8000-memory.dmp

Filesize
544KB

Download
memory/2948-1-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/2948-2-0x0000000005EB0000-0x0000000006454000-memory.dmp

Filesize
5.6MB

Download
memory/2948-8-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

Filesize
64KB

Download
memory/2948-3-0x00000000059E0000-0x0000000005A72000-memory.dmp

Filesize
584KB

Download
memory/2948-47-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/2948-7-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/2948-6-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/2948-11-0x0000000008F70000-0x000000000900C000-memory.dmp

Filesize
624KB

Download
memory/2948-5-0x0000000005A90000-0x0000000005A9A000-memory.dmp

Filesize
40KB

Download
memory/4688-48-0x00000000063D0000-0x0000000006724000-memory.dmp

Filesize
3.3MB

Download
memory/4688-91-0x0000000007EC0000-0x0000000007EDA000-memory.dmp

Filesize
104KB

Download
memory/4688-25-0x0000000005AB0000-0x0000000005B16000-memory.dmp

Filesize
408KB

Download
memory/4688-22-0x0000000003220000-0x0000000003230000-memory.dmp

Filesize
64KB

Download
memory/4688-21-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/4688-70-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/4688-92-0x0000000007EA0000-0x0000000007EA8000-memory.dmp

Filesize
32KB

Download
memory/4688-27-0x0000000006260000-0x00000000062C6000-memory.dmp

Filesize
408KB

Download
memory/4688-90-0x0000000007DC0000-0x0000000007DD4000-memory.dmp

Filesize
80KB

Download
memory/4688-54-0x0000000003220000-0x0000000003230000-memory.dmp

Filesize
64KB

Download
memory/4688-99-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/4688-87-0x0000000003220000-0x0000000003230000-memory.dmp

Filesize
64KB

Download
memory/4688-85-0x0000000007E00000-0x0000000007E96000-memory.dmp

Filesize
600KB

Download
memory/4688-59-0x0000000071450000-0x000000007149C000-memory.dmp

Filesize
304KB

Download
memory/4688-69-0x0000000006E20000-0x0000000006E3E000-memory.dmp

Filesize
120KB

Download
memory/4688-72-0x00000000078C0000-0x0000000007963000-memory.dmp

Filesize
652KB

Download
memory/5092-19-0x0000000005480000-0x0000000005AA8000-memory.dmp

Filesize
6.2MB

Download
memory/5092-58-0x00000000067F0000-0x0000000006822000-memory.dmp

Filesize
200KB

Download
memory/5092-71-0x0000000071450000-0x000000007149C000-memory.dmp

Filesize
304KB

Download
memory/5092-82-0x0000000007B70000-0x00000000081EA000-memory.dmp

Filesize
6.5MB

Download
memory/5092-83-0x0000000007530000-0x000000000754A000-memory.dmp

Filesize
104KB

Download
memory/5092-84-0x00000000075A0000-0x00000000075AA000-memory.dmp

Filesize
40KB

Download
memory/5092-57-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/5092-86-0x0000000007730000-0x0000000007741000-memory.dmp

Filesize
68KB

Download
memory/5092-56-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/5092-88-0x0000000007760000-0x000000000776E000-memory.dmp

Filesize
56KB

Download
memory/5092-55-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/5092-53-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/5092-52-0x00000000062B0000-0x00000000062FC000-memory.dmp

Filesize
304KB

Download
memory/5092-51-0x0000000006200000-0x000000000621E000-memory.dmp

Filesize
120KB

Download
memory/5092-24-0x0000000005240000-0x0000000005262000-memory.dmp

Filesize
136KB

Download
memory/5092-94-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/5092-20-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/5092-18-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/5092-17-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/5092-16-0x0000000002920000-0x0000000002956000-memory.dmp

Filesize
216KB

Download