agenttesla | 67362222dc4dae93f62f984771afb1b9d319ea23335bd4bb4e941f5e1248edc2

Resubmissions

16-02-2024 14:49

240216-r63p5scg33 10

16-02-2024 14:21

240216-rnzkrsbh8v 10

Analysis

max time kernel
75s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20231215-es
resource tags

arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
16-02-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EWW.exe
Size

920KB
MD5

8077b3e5a20f5d489fa82982140733ab
SHA1

52a097dfa8e24b4ab52c9cae829df1b38ecc4e84
SHA256

67362222dc4dae93f62f984771afb1b9d319ea23335bd4bb4e941f5e1248edc2
SHA512

580c5888489d575fcc1e4e0a802ee125e9036761436ed1b58ae9e51e0e6bc5e025a892328cda12530b5343f8ace9bdba967bdeaca982190d3ad39fc0bad0d6e2
SSDEEP

24576:pRmJkcoQricOIQxiZY1iaM/U48ni1dq6ReVbi4:mJZoQrbTFZY1iaM/vuWdq6O

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.awelleh3.top
Port:
587
Username:
[email protected]
Password:
54x%ex3wbV$1
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org
13	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2688 set thread context of 436	2688	EWW.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	RegSvcs.exe
436	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2688	EWW.exe
2688	EWW.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3056	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 436	2688	EWW.exe	84
PID 2688 wrote to memory of 436	2688	EWW.exe	84
PID 2688 wrote to memory of 436	2688	EWW.exe	84
PID 2688 wrote to memory of 436	2688	EWW.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\EWW.exe
"C:\Users\Admin\AppData\Local\Temp\EWW.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\EWW.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-11-0x00000000005C0000-0x0000000000602000-memory.dmp

Filesize
264KB

Download
memory/436-12-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/436-13-0x00000000052A0000-0x0000000005844000-memory.dmp

Filesize
5.6MB

Download
memory/436-14-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/436-15-0x0000000004D60000-0x0000000004DC6000-memory.dmp

Filesize
408KB

Download
memory/436-16-0x0000000006100000-0x0000000006202000-memory.dmp

Filesize
1.0MB

Download
memory/436-17-0x0000000006080000-0x00000000060D0000-memory.dmp

Filesize
320KB

Download
memory/436-18-0x00000000062B0000-0x0000000006342000-memory.dmp

Filesize
584KB

Download
memory/436-19-0x00000000060F0000-0x00000000060FA000-memory.dmp

Filesize
40KB

Download
memory/436-20-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/436-21-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/2688-10-0x00000000032A0000-0x00000000032A4000-memory.dmp

Filesize
16KB

Download