agenttesla | 8449533d515571c2836e39c2d5f6a9a94478011b7d8b5e1add15b18d4664d8c4

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

163ee4a22ca4f4f8ec0cc6f55209ce9a.exe
Size

1.3MB
MD5

163ee4a22ca4f4f8ec0cc6f55209ce9a
SHA1

7d892e1cd8e6019944d559313ad6f1488cfb03c8
SHA256

8449533d515571c2836e39c2d5f6a9a94478011b7d8b5e1add15b18d4664d8c4
SHA512

0808fabd93acfea2ecb632fb255ba58368a057ee7253948c03ad3356f043dec5d725a45c4cd7995bbec0594c545b61ebccb1b02dbb0b6100dfb089a69f23ccdf
SSDEEP

24576:4YxKCmSjOsBgo0q4wM4iXCfHsmbaR0Y7xDyKt:4KyoHM4iXKsmbaR3NGK

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
graceofgod

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

resource	yara_rule
behavioral1/memory/2352-17-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2352-19-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2352-23-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2352-26-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2352-28-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2352-30-0x0000000004E60000-0x0000000004EA0000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/2520-3-0x00000000004C0000-0x00000000004D2000-memory.dmp	CustAttr

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe
2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe
2352	RegSvcs.exe
2352	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe
Token: SeDebugPrivilege	2352	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2352	RegSvcs.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2616	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	30
PID 2520 wrote to memory of 2616	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	30
PID 2520 wrote to memory of 2616	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	30
PID 2520 wrote to memory of 2616	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	30
PID 2520 wrote to memory of 2620	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	32
PID 2520 wrote to memory of 2620	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	32
PID 2520 wrote to memory of 2620	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	32
PID 2520 wrote to memory of 2620	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	32
PID 2520 wrote to memory of 2620	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	32
PID 2520 wrote to memory of 2620	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	32
PID 2520 wrote to memory of 2620	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	32
PID 2520 wrote to memory of 1676	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	33
PID 2520 wrote to memory of 1676	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	33
PID 2520 wrote to memory of 1676	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	33
PID 2520 wrote to memory of 1676	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	33
PID 2520 wrote to memory of 1676	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	33
PID 2520 wrote to memory of 1676	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	33
PID 2520 wrote to memory of 1676	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	33
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34
PID 2520 wrote to memory of 2352	2520	163ee4a22ca4f4f8ec0cc6f55209ce9a.exe	34

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\163ee4a22ca4f4f8ec0cc6f55209ce9a.exe
"C:\Users\Admin\AppData\Local\Temp\163ee4a22ca4f4f8ec0cc6f55209ce9a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DBJSgOjyP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AFE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3AFE.tmp

Filesize
1KB

MD5
f392e97664434ad35225bd677aa2df1c

SHA1
bba35ed724163f3be2c6fbf69f2114a34f927c96

SHA256
724ed5004576a7ddb25aa22dfe800e73f4a62117b00d9bda8141664f254b2280

SHA512
a332c614325fecb0e4164e8b62db4e3108dce925554e6ceb0c6a84af5518b89e83624aff60f484fe3d60eef01cca157093f16c33100957f5ae9647993f58a25e

Download Submit
memory/2352-29-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-28-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2352-34-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/2352-33-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/2352-32-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/2352-31-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-30-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/2352-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2352-19-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2352-15-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2352-17-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2352-13-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2352-26-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2352-23-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2520-25-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2520-1-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2520-2-0x0000000000570000-0x00000000005B0000-memory.dmp

Filesize
256KB

Download
memory/2520-0-0x00000000009C0000-0x0000000000B0E000-memory.dmp

Filesize
1.3MB

Download
memory/2520-7-0x00000000005F0000-0x000000000063C000-memory.dmp

Filesize
304KB

Download
memory/2520-6-0x0000000005630000-0x00000000056C4000-memory.dmp

Filesize
592KB

Download
memory/2520-5-0x0000000000570000-0x00000000005B0000-memory.dmp

Filesize
256KB

Download
memory/2520-4-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2520-3-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download