agenttesla | 58924b2968d04cc20ff58b4d0c4c220f7109eefb13db6b348aa2754293fbfe85

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P.O 2320505.exe
Size 627KB
Sample240122-lz3hxaebe2
SHA256 58924b2968d04cc20ff58b4d0c4c220f7109eefb13db6b348aa2754293fbfe85
MD5 dde6e773ee25de015aa829a3a24e55ee
SHA1 b55763486cc5c3c43dee87598d96954e7ab17446
SHA512 c200ac062718ed4d49cac4910b7f174993fbe56a90466ee43e415d9920b4e1767e1cbb2641fb640e0292fe7eba3eb7c350ca461522a8a1c6f59f06f7f4d4b8d9
SSDEEP 12288:Fkf+QkjQwfWk7H9EMajfjAV5fYL91uCFPEzo90dUC:K5kUiWk7H9EM88VVYLTuC92i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.commtechtrading.com
Port
587
Username
[email protected]
Password
;elP@ho2Np 7[
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 2736	2088	P.O 2320505.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2088	P.O 2320505.exe
2088	P.O 2320505.exe
2088	P.O 2320505.exe
2736	P.O 2320505.exe
2736	P.O 2320505.exe
3032	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	P.O 2320505.exe
Token: SeDebugPrivilege	2736	P.O 2320505.exe
Token: SeDebugPrivilege	3032	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3032	2088	P.O 2320505.exe	28
PID 2088 wrote to memory of 3032	2088	P.O 2320505.exe	28
PID 2088 wrote to memory of 3032	2088	P.O 2320505.exe	28
PID 2088 wrote to memory of 3032	2088	P.O 2320505.exe	28
PID 2088 wrote to memory of 2660	2088	P.O 2320505.exe	30
PID 2088 wrote to memory of 2660	2088	P.O 2320505.exe	30
PID 2088 wrote to memory of 2660	2088	P.O 2320505.exe	30
PID 2088 wrote to memory of 2660	2088	P.O 2320505.exe	30
PID 2088 wrote to memory of 2696	2088	P.O 2320505.exe	32
PID 2088 wrote to memory of 2696	2088	P.O 2320505.exe	32
PID 2088 wrote to memory of 2696	2088	P.O 2320505.exe	32
PID 2088 wrote to memory of 2696	2088	P.O 2320505.exe	32
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33
PID 2088 wrote to memory of 2736	2088	P.O 2320505.exe	33

C:\Users\Admin\AppData\Local\Temp\P.O 2320505.exe
"C:\Users\Admin\AppData\Local\Temp\P.O 2320505.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UgxQXsLttkstm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UgxQXsLttkstm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp470E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\P.O 2320505.exe
  "C:\Users\Admin\AppData\Local\Temp\P.O 2320505.exe"
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\P.O 2320505.exe
  "C:\Users\Admin\AppData\Local\Temp\P.O 2320505.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp470E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp470E.tmp
Size 1KB
SHA256 2321371b3018ffee7dd14ff578f2bafa1dff558fb4f02cb631c8641b7729d996
MD5 69281e15f1b894d7fa28ee02916ee1b5
SHA1 5e865cbbd9e85467303f14a263bb3e9bceba5827
SHA512 4fe2705eb87b8d50d09aec82c457fd3fce2f31f9bc8e9ab0e2ef71aa867286547c27ea8abc69f40ab525a5d2ac7b26c41ab6ae4b0b74e177c359201d29efcdff
MD5 SHA1 SHA512

Submit Download

memory/2088-29-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/2088-1-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/2088-2-0x0000000004D40000-0x0000000004D80000-memory.dmp

Download

memory/2088-3-0x00000000004F0000-0x0000000000504000-memory.dmp

Download

memory/2088-4-0x0000000000850000-0x0000000000858000-memory.dmp

Download

memory/2088-5-0x0000000000860000-0x000000000086C000-memory.dmp

Download

memory/2088-6-0x0000000004E60000-0x0000000004EDA000-memory.dmp

Download

memory/2088-0-0x0000000000870000-0x0000000000912000-memory.dmp

Download

memory/2736-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2736-34-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/2736-16-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2736-14-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2736-26-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2736-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2736-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2736-20-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2736-39-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/2736-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2736-32-0x0000000000370000-0x00000000003B0000-memory.dmp

Download

memory/2736-38-0x0000000000370000-0x00000000003B0000-memory.dmp

Download

memory/3032-33-0x0000000002730000-0x0000000002770000-memory.dmp

Download

memory/3032-35-0x0000000002730000-0x0000000002770000-memory.dmp

Download

memory/3032-36-0x000000006E8C0000-0x000000006EE6B000-memory.dmp

Download

memory/3032-37-0x000000006E8C0000-0x000000006EE6B000-memory.dmp

Download

memory/3032-31-0x0000000002730000-0x0000000002770000-memory.dmp

Download

memory/3032-30-0x000000006E8C0000-0x000000006EE6B000-memory.dmp

Download