agenttesla | d69af24cb696c4e9de1910acdbced3b8f912e61591c0308a8de7fd798b86ecea

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bb6023d672f8817aebd54a3e54c82e2.exe
Size 1020KB
Sample240217-e2hsysbd29
SHA256 d69af24cb696c4e9de1910acdbced3b8f912e61591c0308a8de7fd798b86ecea
MD5 6bb6023d672f8817aebd54a3e54c82e2
SHA1 8060d4863cefd3ad6334c20b7230b739a2038db0
SHA512 ab8e173ea35254ae2fd82778639517d60765f241b1c6e2c89efec9e44369f7677ab9347d54ea79e33e2f48ab819b17a38b340817131e1d916ec1c4d9ffabefec
SSDEEP 12288:IhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4az6ooSVYQxRS4XqJcFSEaF:wRmJkcoQricOIQxiZY1iazbUQxUJJuC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.worlorderbillions.top
Port
587
Username
[email protected]
Password
~lhTqZ3?QKP@
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2940	RegSvcs.exe
2940	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2240	6bb6023d672f8817aebd54a3e54c82e2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28
PID 2240 wrote to memory of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28
PID 2240 wrote to memory of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28
PID 2240 wrote to memory of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28
PID 2240 wrote to memory of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28
PID 2240 wrote to memory of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28
PID 2240 wrote to memory of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28
PID 2240 wrote to memory of 2940	2240	6bb6023d672f8817aebd54a3e54c82e2.exe	28

C:\Users\Admin\AppData\Local\Temp\6bb6023d672f8817aebd54a3e54c82e2.exe
"C:\Users\Admin\AppData\Local\Temp\6bb6023d672f8817aebd54a3e54c82e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\6bb6023d672f8817aebd54a3e54c82e2.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-10-0x0000000000970000-0x0000000000974000-memory.dmp

Download

memory/2940-11-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2940-13-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2940-15-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2940-16-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Download

memory/2940-17-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Download