agenttesla | 5960d043c0b3f18e43855fd37a9452db44fc1e5dc64647d65b0c6f1ee6d18e33

Analysis

max time kernel
171s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Doc_5102_7185_000186xls.exe
Size

77KB
MD5

12eaf84b10400df008e0643f19ae8df4
SHA1

e130629af89b37096d7790fee637783a97762173
SHA256

5960d043c0b3f18e43855fd37a9452db44fc1e5dc64647d65b0c6f1ee6d18e33
SHA512

f47984ef46162eaa9cd6a592c9b7648acc6bdb62c48f47d96b10df96cc87db2c502472901fc578ed0a38c23554793e80ff58246b8b6845a168598b4847d1fd59
SSDEEP

1536:Kvi6/W+j29YNg0ZxFPgFVrNF5du729tZCi:/6cgPu5uS9PT

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
server1.sqsendy.shop
Port:
587
Username:
[email protected]
Password:
{f];qthoiBBW
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rnolscbvc = "C:\\Users\\Admin\\AppData\\Roaming\\Rnolscbvc.exe"	Doc_5102_7185_000186xls.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2700 set thread context of 4604	2700	Doc_5102_7185_000186xls.exe	109

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2700	Doc_5102_7185_000186xls.exe
2700	Doc_5102_7185_000186xls.exe
4604	Doc_5102_7185_000186xls.exe
4604	Doc_5102_7185_000186xls.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	Doc_5102_7185_000186xls.exe
Token: SeDebugPrivilege	4604	Doc_5102_7185_000186xls.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2512	2700	Doc_5102_7185_000186xls.exe	108
PID 2700 wrote to memory of 2512	2700	Doc_5102_7185_000186xls.exe	108
PID 2700 wrote to memory of 2512	2700	Doc_5102_7185_000186xls.exe	108
PID 2700 wrote to memory of 4604	2700	Doc_5102_7185_000186xls.exe	109
PID 2700 wrote to memory of 4604	2700	Doc_5102_7185_000186xls.exe	109
PID 2700 wrote to memory of 4604	2700	Doc_5102_7185_000186xls.exe	109
PID 2700 wrote to memory of 4604	2700	Doc_5102_7185_000186xls.exe	109
PID 2700 wrote to memory of 4604	2700	Doc_5102_7185_000186xls.exe	109
PID 2700 wrote to memory of 4604	2700	Doc_5102_7185_000186xls.exe	109
PID 2700 wrote to memory of 4604	2700	Doc_5102_7185_000186xls.exe	109
PID 2700 wrote to memory of 4604	2700	Doc_5102_7185_000186xls.exe	109

C:\Users\Admin\AppData\Local\Temp\Doc_5102_7185_000186xls.exe
"C:\Users\Admin\AppData\Local\Temp\Doc_5102_7185_000186xls.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\Doc_5102_7185_000186xls.exe
  C:\Users\Admin\AppData\Local\Temp\Doc_5102_7185_000186xls.exe
  2⤵
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\Doc_5102_7185_000186xls.exe
  C:\Users\Admin\AppData\Local\Temp\Doc_5102_7185_000186xls.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-8-0x0000000006580000-0x00000000065C0000-memory.dmp

Filesize
256KB

Download
memory/2700-10-0x0000000005020000-0x000000000506C000-memory.dmp

Filesize
304KB

Download
memory/2700-2-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/2700-3-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2700-4-0x00000000056D0000-0x0000000005C74000-memory.dmp

Filesize
5.6MB

Download
memory/2700-5-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2700-6-0x00000000051C0000-0x0000000005252000-memory.dmp

Filesize
584KB

Download
memory/2700-7-0x0000000005660000-0x00000000056B8000-memory.dmp

Filesize
352KB

Download
memory/2700-1-0x00000000000B0000-0x00000000000CA000-memory.dmp

Filesize
104KB

Download
memory/2700-0-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/2700-9-0x0000000004FE0000-0x0000000005020000-memory.dmp

Filesize
256KB

Download
memory/2700-16-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/4604-13-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/4604-15-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4604-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4604-17-0x0000000005420000-0x0000000005486000-memory.dmp

Filesize
408KB

Download
memory/4604-18-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/4604-19-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download