agenttesla | 67362222dc4dae93f62f984771afb1b9d319ea23335bd4bb4e941f5e1248edc2

Resubmissions

16-02-2024 14:49

240216-r63p5scg33 10

16-02-2024 14:21

240216-rnzkrsbh8v 10

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EWW.exe
Size

920KB
MD5

8077b3e5a20f5d489fa82982140733ab
SHA1

52a097dfa8e24b4ab52c9cae829df1b38ecc4e84
SHA256

67362222dc4dae93f62f984771afb1b9d319ea23335bd4bb4e941f5e1248edc2
SHA512

580c5888489d575fcc1e4e0a802ee125e9036761436ed1b58ae9e51e0e6bc5e025a892328cda12530b5343f8ace9bdba967bdeaca982190d3ad39fc0bad0d6e2
SSDEEP

24576:pRmJkcoQricOIQxiZY1iaM/U48ni1dq6ReVbi4:mJZoQrbTFZY1iaM/vuWdq6O

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.awelleh3.top
Port:
587
Username:
[email protected]
Password:
54x%ex3wbV$1
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 api.ipify.org
17 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

EWW.exe

description pid process target process

PID 680 set thread context of 4580 680 EWW.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

4580 RegSvcs.exe
4580 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

EWW.exe

pid process

680 EWW.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 4580 RegSvcs.exe

flow	ioc
16	api.ipify.org
17	api.ipify.org

description	pid	process	target process
PID 680 set thread context of 4580	680	EWW.exe	RegSvcs.exe

pid	process
4580	RegSvcs.exe
4580	RegSvcs.exe

pid	process
680	EWW.exe

description	pid	process
Token: SeDebugPrivilege	4580	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EWW.exe

description	pid	process	target process
PID 680 wrote to memory of 4580	680	EWW.exe	RegSvcs.exe
PID 680 wrote to memory of 4580	680	EWW.exe	RegSvcs.exe
PID 680 wrote to memory of 4580	680	EWW.exe	RegSvcs.exe
PID 680 wrote to memory of 4580	680	EWW.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\EWW.exe
"C:\Users\Admin\AppData\Local\Temp\EWW.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\EWW.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/680-10-0x0000000003380000-0x0000000003384000-memory.dmp

Filesize
16KB

Download
memory/4580-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4580-12-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/4580-13-0x0000000005A60000-0x0000000006004000-memory.dmp

Filesize
5.6MB

Download
memory/4580-14-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/4580-15-0x0000000005410000-0x0000000005476000-memory.dmp

Filesize
408KB

Download
memory/4580-16-0x0000000006AB0000-0x0000000006B00000-memory.dmp

Filesize
320KB

Download
memory/4580-17-0x0000000006BA0000-0x0000000006C32000-memory.dmp

Filesize
584KB

Download
memory/4580-18-0x0000000006B20000-0x0000000006B2A000-memory.dmp

Filesize
40KB

Download
memory/4580-19-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/4580-20-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download