Overview
overview
10Static
static
10231121-01-...d4.exe
windows7-x64
10231121-01-...d4.exe
windows10-2004-x64
10231121-02-...4c.exe
windows7-x64
10231121-02-...4c.exe
windows10-2004-x64
10231121-03-...94.exe
windows7-x64
10231121-03-...94.exe
windows10-2004-x64
10231121-04-...05.exe
windows7-x64
10231121-04-...05.exe
windows10-2004-x64
10231121-05-...29.exe
windows7-x64
10231121-05-...29.exe
windows10-2004-x64
10231121-06-...a6.exe
windows7-x64
10231121-06-...a6.exe
windows10-2004-x64
10231121-07-...6a.exe
windows7-x64
10231121-07-...6a.exe
windows10-2004-x64
10231121-08-...84.exe
windows7-x64
10231121-08-...84.exe
windows10-2004-x64
10231121-09-...c4.exe
windows7-x64
10231121-09-...c4.exe
windows10-2004-x64
10231121-10-...ec.exe
windows7-x64
10231121-10-...ec.exe
windows10-2004-x64
10231121-11-...bc.exe
windows7-x64
10231121-11-...bc.exe
windows10-2004-x64
10231121-12-...1d.exe
windows7-x64
10231121-12-...1d.exe
windows10-2004-x64
10231121-13-...5e.exe
windows7-x64
10231121-13-...5e.exe
windows10-2004-x64
10231121-14-...29.exe
windows7-x64
10231121-14-...29.exe
windows10-2004-x64
10231121-15-...f4.exe
windows7-x64
3231121-15-...f4.exe
windows10-2004-x64
10231121-16-...00.exe
windows7-x64
10231121-16-...00.exe
windows10-2004-x64
10Analysis
-
max time kernel
135s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2023 02:01
Behavioral task
behavioral1
Sample
231121-01-AgentTesla-4f4bd4.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
231121-01-AgentTesla-4f4bd4.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
231121-02-AgentTesla-29ec4c.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
231121-02-AgentTesla-29ec4c.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
231121-03-SmokeLoader-a0e394.exe
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
231121-03-SmokeLoader-a0e394.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
231121-04-AgentTesla-41c205.exe
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
231121-04-AgentTesla-41c205.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
231121-05-CobaltStrike-189129.exe
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
231121-05-CobaltStrike-189129.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
231121-06-AgentTesla-b971a6.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
231121-06-AgentTesla-b971a6.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
231121-07-AgentTesla-64b66a.exe
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
231121-07-AgentTesla-64b66a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
231121-08-AgentTesla-d20084.exe
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
231121-08-AgentTesla-d20084.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
231121-09-AgentTesla-fbf7c4.exe
Resource
win7-20231025-en
Behavioral task
behavioral18
Sample
231121-09-AgentTesla-fbf7c4.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
231121-10-AgentTesla-a77eec.exe
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
231121-10-AgentTesla-a77eec.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
231121-11-AgentTesla-fe5abc.exe
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
231121-11-AgentTesla-fe5abc.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral23
Sample
231121-12-AgentTesla-68ee1d.exe
Resource
win7-20231020-en
Behavioral task
behavioral24
Sample
231121-12-AgentTesla-68ee1d.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral25
Sample
231121-13-AgentTesla-4c625e.exe
Resource
win7-20231023-en
Behavioral task
behavioral26
Sample
231121-13-AgentTesla-4c625e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral27
Sample
231121-14-AgentTesla-1fcc29.exe
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
231121-14-AgentTesla-1fcc29.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral29
Sample
231121-15-Lokibot-a3aaf4.exe
Resource
win7-20231023-en
Behavioral task
behavioral30
Sample
231121-15-Lokibot-a3aaf4.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral31
Sample
231121-16-Lime-098e00.exe
Resource
win7-20231020-en
General
-
Target
231121-09-AgentTesla-fbf7c4.exe
-
Size
247KB
-
MD5
2f879d56d9598e574c741396c5f756be
-
SHA1
fbf7c47229c56ccddbbd757e0f48eb0d45b5c68a
-
SHA256
488b5c24fae2c85b0e9d2c26cb85992d5fd7f0cec219a0a818d648a9890c491d
-
SHA512
371d504f33e86fb18643ed58577b1b31e11949d330abe7814340c82082787593cb07a377c3fb39ac40dc2569894fda164e88eaae50a8c51a74520a836a37bcae
-
SSDEEP
6144:fcIUpNx1hNkchYyWn1YGn6ou0KDJHZ2t:7UpNx1hNkchtWnOG9u0KDK
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.globalifb.com - Port:
587 - Username:
[email protected] - Password:
$;oGh3?)CQiY - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox = "C:\\Users\\Admin\\AppData\\Local\\Temp\\firefox\\firefox.exe" 231121-09-AgentTesla-fbf7c4.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 53 api.ipify.org 54 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1260 231121-09-AgentTesla-fbf7c4.exe 1260 231121-09-AgentTesla-fbf7c4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1260 231121-09-AgentTesla-fbf7c4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1260 231121-09-AgentTesla-fbf7c4.exe