agenttesla | 6c7a86fab40be3fa9a95bbeb52f9c790d239646d0ff8504cfa5629f4fd9a1f42

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231201-en
resource tags

arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
submitted
11-12-2023 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5041673918XXXXX.BAT.exe
Size

330KB
MD5

936f0aaff53261396d764a5429c6a05e
SHA1

c9b23f881ef506918a8b90a6789878e130fc2d55
SHA256

6c7a86fab40be3fa9a95bbeb52f9c790d239646d0ff8504cfa5629f4fd9a1f42
SHA512

84fa483869c5307f31496cc66847f777e8ddfe677b2694ec83385dddd34a0a571f36aa50edb39d4da5961346a62e161097c5e62e710795fd8569cfc2f76af967
SSDEEP

6144:P8LxBs9bI62/EJuzNsHyAOhJsiBQqu7mycVtXBpve5CzmTc/bfq6PfqpctSbT9k7:B1Ip85yAKJsienHqtuCzJTfPSYSbY

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

hffhzbqjsu.exehffhzbqjsu.exe

pid process

2808 hffhzbqjsu.exe
2764 hffhzbqjsu.exe
Loads dropped DLL 6 IoCs

Processes:

5041673918XXXXX.BAT.exehffhzbqjsu.exeWerFault.exe

pid process

1928 5041673918XXXXX.BAT.exe
1928 5041673918XXXXX.BAT.exe
2808 hffhzbqjsu.exe
2776 WerFault.exe
2776 WerFault.exe
2776 WerFault.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2808	hffhzbqjsu.exe
2764	hffhzbqjsu.exe

pid	process
1928	5041673918XXXXX.BAT.exe
1928	5041673918XXXXX.BAT.exe
2808	hffhzbqjsu.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2764-14-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/2764-17-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/2764-21-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/2764-18-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/2764-28-0x0000000001270000-0x00000000012B0000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

hffhzbqjsu.exehffhzbqjsu.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1514849007-2165033493-4114354048-1000\Software\Microsoft\Windows\CurrentVersion\Run\wgcktpyienjsc = "C:\\Users\\Admin\\AppData\\Roaming\\ejsoxt\\dmirb.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hffhzbqjsu.exe\" "	hffhzbqjsu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1514849007-2165033493-4114354048-1000\Software\Microsoft\Windows\CurrentVersion\Run\M yApp = "C:\\Users\\Admin\\AppData\\Roaming\\M yApp\\M yApp.exe"	hffhzbqjsu.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

hffhzbqjsu.exe

description pid process target process

PID 2808 set thread context of 2764 2808 hffhzbqjsu.exe hffhzbqjsu.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2776 2808 WerFault.exe hffhzbqjsu.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

hffhzbqjsu.exe

pid process

2764 hffhzbqjsu.exe
2764 hffhzbqjsu.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

hffhzbqjsu.exe

pid process

2808 hffhzbqjsu.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

hffhzbqjsu.exe

description pid process

Token: SeDebugPrivilege 2764 hffhzbqjsu.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process	target process
PID 2808 set thread context of 2764	2808	hffhzbqjsu.exe	hffhzbqjsu.exe

pid	pid_target	process	target process
2776	2808	WerFault.exe	hffhzbqjsu.exe

pid	process
2764	hffhzbqjsu.exe
2764	hffhzbqjsu.exe

pid	process
2808	hffhzbqjsu.exe

description	pid	process
Token: SeDebugPrivilege	2764	hffhzbqjsu.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

5041673918XXXXX.BAT.exehffhzbqjsu.exe

description	pid	process	target process
PID 1928 wrote to memory of 2808	1928	5041673918XXXXX.BAT.exe	hffhzbqjsu.exe
PID 1928 wrote to memory of 2808	1928	5041673918XXXXX.BAT.exe	hffhzbqjsu.exe
PID 1928 wrote to memory of 2808	1928	5041673918XXXXX.BAT.exe	hffhzbqjsu.exe
PID 1928 wrote to memory of 2808	1928	5041673918XXXXX.BAT.exe	hffhzbqjsu.exe
PID 2808 wrote to memory of 2764	2808	hffhzbqjsu.exe	hffhzbqjsu.exe
PID 2808 wrote to memory of 2764	2808	hffhzbqjsu.exe	hffhzbqjsu.exe
PID 2808 wrote to memory of 2764	2808	hffhzbqjsu.exe	hffhzbqjsu.exe
PID 2808 wrote to memory of 2764	2808	hffhzbqjsu.exe	hffhzbqjsu.exe
PID 2808 wrote to memory of 2764	2808	hffhzbqjsu.exe	hffhzbqjsu.exe
PID 2808 wrote to memory of 2776	2808	hffhzbqjsu.exe	WerFault.exe
PID 2808 wrote to memory of 2776	2808	hffhzbqjsu.exe	WerFault.exe
PID 2808 wrote to memory of 2776	2808	hffhzbqjsu.exe	WerFault.exe
PID 2808 wrote to memory of 2776	2808	hffhzbqjsu.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5041673918XXXXX.BAT.exe
"C:\Users\Admin\AppData\Local\Temp\5041673918XXXXX.BAT.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928

C:\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe
"C:\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2808

C:\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe
"C:\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 204
3⤵
- Loads dropped DLL
- Program crash
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe

Filesize
71KB

MD5
2930cf7ccac8eaa0a730a74ec0d48706

SHA1
8b9499b3929f2345e4964a90b1fbdf60cb9cbdac

SHA256
bb772b1b4aebe6402d693e0afd92fe08e4cc9626cce9c626b52834225f02190e

SHA512
62e4e5eab289cd2778a25675e467959166b1670a67fd574e29510a5712735e1324c0e410f54b3da1fe51bd01d989eed39d93a0fa92dbfb572ddb29d041bd3091

Download Submit
C:\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe

Filesize
212KB

MD5
c511cec90db9f2b60caa1903c703f258

SHA1
72458ce7d2328da10150227a49c46f5c2805e5ed

SHA256
4e1d606edf6680c07d5440a448161e26da08f9136d6ad62823ec2712cdfd9bf2

SHA512
c24e24a0951d61285d2c7d40cf4fe30b7aafc69c24d937d5bfab843ecef16b4c3d05cfaa83a0e8cfa56446ba63461a127d3eeef8e57e9f8e88456c636217930c

Download Submit
C:\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe

Filesize
274KB

MD5
5250b553864dfcbad5e0ad2bb2dc6bab

SHA1
18758862255a406690b0bdaca6df4ffe66de5d78

SHA256
1ce08705ab6b650f8fa900e78913ccf41c2c9c1589218975551d54ddbd657196

SHA512
988326c973e55fa88d2e5681ccb8717dcf6b3c2c0046f497de4f2483e63bd8f7ac2d8a633a28e850d255bb5b9d524a8cb458d13b14cb4249e1eb41589523c432

Download Submit
C:\Users\Admin\AppData\Local\Temp\rvaxxork.y

Filesize
26KB

MD5
06ec9fc6318e8846aa2e7a6006352046

SHA1
68ae219eba4114da2efdec2def7ed241274d6d2c

SHA256
fdd2525bb43024af01cf5251ac05b152ee66600bb66ae42dc9c0b8b9fc9da659

SHA512
d2b3131549c8a7c9439d7648f153a0845085439d2ff6753219a800ad3bc0c2fdff028cf72202027b8fc5ad242cf1f040c1b16e4e59065672cf7fba13476a1fe5

Download Submit
\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe

Filesize
4KB

MD5
7ad944e8fd21373f304516f6b176edfb

SHA1
21a6519d1f9c070d53894145fdfd1567a767b20f

SHA256
7a599c19dcf426ed113c9d28d423177297f3af27e8d33dac0d926afe36f622b7

SHA512
c4bbf18e9d3c63464b1a102edd18f9a82d8f4c8384daecd5e2a8d4580b5247fc808d0c6c296b97ce9d8ee7f9fab6eed11579193f407da1ab1e9d6f6084be9778

Download Submit
\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe

Filesize
298KB

MD5
2e7dcc9c6f336cd6352f2da45de28d00

SHA1
ca23f4532ec078d757aa90d0f4018ee86c25e8f1

SHA256
4d4ea573023a4362be5fd6780672f4af67c2c7ffae508888a7e6b89bbde11d21

SHA512
007499ca22cc3f2fd0da8448fec20e74d8c9ce8210d6c1c9e0726f571607d0a4097949ea2a9845be52eb6dfa8ce2a8d62c5125e7ce6d226e92ec68ce073a59c1

Download Submit
\Users\Admin\AppData\Local\Temp\hffhzbqjsu.exe

Filesize
163KB

MD5
3bb7ac926106f1c9a1463b6588ef8e9f

SHA1
6958485e3b8e9807b51f1e3d0d091ae8edf58724

SHA256
3e718eac48c0cf39c14a7e2aea88b3e93ab7078b62218ceb0debb05fd71ea5b4

SHA512
5f13a778809df1e5c7e5d26e1f9d8e446d3ff476e9cad43b4cb9ef8179462b3d649e7fb871ba98c4d9ac2892c6ad6bae37721ac7446a78c880380f67b0095025

Download Submit
memory/2764-23-0x0000000000A40000-0x0000000000A82000-memory.dmp

Filesize
264KB

Download
memory/2764-14-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2764-17-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2764-21-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2764-18-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2764-24-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-26-0x0000000001270000-0x00000000012B0000-memory.dmp

Filesize
256KB

Download
memory/2764-25-0x0000000001270000-0x00000000012B0000-memory.dmp

Filesize
256KB

Download
memory/2764-27-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-28-0x0000000001270000-0x00000000012B0000-memory.dmp

Filesize
256KB

Download
memory/2808-9-0x00000000000E0000-0x00000000000E2000-memory.dmp

Filesize
8KB

Download