agenttesla | f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b

General

Target

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
Size

8.0MB
MD5

3415d0d8eb2143284827fe443a317dc1
SHA1

ae927f104a4755cf28204e1818a7f7cdca484485
SHA256

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b
SHA512

cde4cb9981d8bb2114821aa0f66a2b5db472730067c7a40ed4b3f8cb7c733eb8bd37ae413ad74670bf76ce31e498fb4af83cd60fc50ccec2dd49a0f39796ad83
SSDEEP

98304:AddhXpr5FO4qPdudczq7a/e1QCyTxvDWHQg2RMYKqUrNqEK:AdXXpr5FO4qVudrIxvCj2RfKqUrNqT

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.marinasands.gr
Port:
587
Username:
[email protected]
Password:
2WKm}0K~,RiV
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

4652 svchost.exe

pid	process
4652	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

46 api.ipify.org
47 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 4652 set thread context of 4968 4652 svchost.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1760 4968 WerFault.exe InstallUtil.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2824 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3824 timeout.exe

flow	ioc
46	api.ipify.org
47	api.ipify.org

description	pid	process	target process
PID 4652 set thread context of 4968	4652	svchost.exe	InstallUtil.exe

pid	pid_target	process	target process
1760	4968	WerFault.exe	InstallUtil.exe

pid	process
2824	schtasks.exe

pid	process
3824	timeout.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exesvchost.exeInstallUtil.exe

pid	process
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
4652	svchost.exe
4652	svchost.exe
4652	svchost.exe
4652	svchost.exe
4968	InstallUtil.exe
4968	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exesvchost.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
Token: SeDebugPrivilege	4652	svchost.exe
Token: SeDebugPrivilege	4968	InstallUtil.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.execmd.execmd.exesvchost.exe

description	pid	process	target process
PID 2088 wrote to memory of 3732	2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2088 wrote to memory of 3732	2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2088 wrote to memory of 3732	2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2088 wrote to memory of 1128	2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2088 wrote to memory of 1128	2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2088 wrote to memory of 1128	2088	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 3732 wrote to memory of 2824	3732	cmd.exe	schtasks.exe
PID 3732 wrote to memory of 2824	3732	cmd.exe	schtasks.exe
PID 3732 wrote to memory of 2824	3732	cmd.exe	schtasks.exe
PID 1128 wrote to memory of 3824	1128	cmd.exe	timeout.exe
PID 1128 wrote to memory of 3824	1128	cmd.exe	timeout.exe
PID 1128 wrote to memory of 3824	1128	cmd.exe	timeout.exe
PID 1128 wrote to memory of 4652	1128	cmd.exe	svchost.exe
PID 1128 wrote to memory of 4652	1128	cmd.exe	svchost.exe
PID 1128 wrote to memory of 4652	1128	cmd.exe	svchost.exe
PID 4652 wrote to memory of 4428	4652	svchost.exe	CasPol.exe
PID 4652 wrote to memory of 4428	4652	svchost.exe	CasPol.exe
PID 4652 wrote to memory of 4428	4652	svchost.exe	CasPol.exe
PID 4652 wrote to memory of 3712	4652	svchost.exe	AddInProcess32.exe
PID 4652 wrote to memory of 3712	4652	svchost.exe	AddInProcess32.exe
PID 4652 wrote to memory of 3712	4652	svchost.exe	AddInProcess32.exe
PID 4652 wrote to memory of 4968	4652	svchost.exe	InstallUtil.exe
PID 4652 wrote to memory of 4968	4652	svchost.exe	InstallUtil.exe
PID 4652 wrote to memory of 4968	4652	svchost.exe	InstallUtil.exe
PID 4652 wrote to memory of 4968	4652	svchost.exe	InstallUtil.exe
PID 4652 wrote to memory of 4968	4652	svchost.exe	InstallUtil.exe
PID 4652 wrote to memory of 4968	4652	svchost.exe	InstallUtil.exe
PID 4652 wrote to memory of 4968	4652	svchost.exe	InstallUtil.exe
PID 4652 wrote to memory of 4968	4652	svchost.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
"C:\Users\Admin\AppData\Local\Temp\f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
3⤵
- Creates scheduled task(s)
PID:2824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7956.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:3824

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
4⤵
PID:4428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
4⤵
PID:3712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1968
5⤵
- Program crash
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4968 -ip 4968
1⤵
PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7956.tmp.bat

Filesize
151B

MD5
2626d7db00340fd2cab4449664776d9b

SHA1
e9396656d493b7e507b4dc7101e6fd23a525a6e9

SHA256
60ae71fed44668be7fcf9f3549ad8a445684b8c11e680d45ddf40a23a790976e

SHA512
4d06aed90edb396a9b05f7112db508a886639f0b492c835bc5839cc5635a2dd18ba21be871c5d7421a839dd32b8f8ca16ec771980df89ff34131f14e59531778

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
8.0MB

MD5
3415d0d8eb2143284827fe443a317dc1

SHA1
ae927f104a4755cf28204e1818a7f7cdca484485

SHA256
f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b

SHA512
cde4cb9981d8bb2114821aa0f66a2b5db472730067c7a40ed4b3f8cb7c733eb8bd37ae413ad74670bf76ce31e498fb4af83cd60fc50ccec2dd49a0f39796ad83

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
8.0MB

MD5
3415d0d8eb2143284827fe443a317dc1

SHA1
ae927f104a4755cf28204e1818a7f7cdca484485

SHA256
f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b

SHA512
cde4cb9981d8bb2114821aa0f66a2b5db472730067c7a40ed4b3f8cb7c733eb8bd37ae413ad74670bf76ce31e498fb4af83cd60fc50ccec2dd49a0f39796ad83

Download Submit
memory/2088-5-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Filesize
120KB

Download
memory/2088-1-0x0000000000B90000-0x0000000001398000-memory.dmp

Filesize
8.0MB

Download
memory/2088-0-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/2088-6-0x0000000005FD0000-0x0000000005FE0000-memory.dmp

Filesize
64KB

Download
memory/2088-7-0x00000000061F0000-0x0000000006284000-memory.dmp

Filesize
592KB

Download
memory/2088-8-0x0000000005FB0000-0x0000000005FCA000-memory.dmp

Filesize
104KB

Download
memory/2088-13-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/2088-3-0x0000000005E30000-0x0000000005EC2000-memory.dmp

Filesize
584KB

Download
memory/2088-2-0x00000000062D0000-0x0000000006874000-memory.dmp

Filesize
5.6MB

Download
memory/2088-4-0x0000000005ED0000-0x0000000005F46000-memory.dmp

Filesize
472KB

Download
memory/4652-18-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/4652-21-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/4968-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4968-22-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/4968-23-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/4968-24-0x0000000005580000-0x00000000055E6000-memory.dmp

Filesize
408KB

Download
memory/4968-25-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads