agenttesla | 5746f44f3a3bca690d30ee45e179bcf003c7759b20a0394563cb30e3d2b4e6ea

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW PURCHASE ORDER.png.exe
Size 676KB
Sample240228-he7eksdf52
SHA256 5746f44f3a3bca690d30ee45e179bcf003c7759b20a0394563cb30e3d2b4e6ea
MD5 cd8c86ad3730b12ad62aa8efd35128eb
SHA1 f5ccdad58a67f313f755fa44df410a4818a765f4
SHA512 a0cfd865d49f7622e4eeb789578382ff9256fbbe21f7b62205417e37c1df9f4c85c2131745358192729d54bd17350c5ebc055ab316c27a7d4b17f881aeba8a9f
SSDEEP 12288:qzNwnqs3y44sAG9IfTE0GjlFdDCJYvHn82JoqBenNAAxaCGJ+ZKu0BBvwcMRHgCz:fnPAG9IfRclXJvH3mqBuNAOaJxuGmcq5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.unitech-co.com.tr
Port
587
Username
[email protected]
Password
Mm@57650Mm
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 2496	2276	NEW PURCHASE ORDER.png.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
2276	NEW PURCHASE ORDER.png.exe
1988	powershell.exe
2440	powershell.exe
2496	RegSvcs.exe
2496	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	NEW PURCHASE ORDER.png.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2496	RegSvcs.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2440	2276	NEW PURCHASE ORDER.png.exe	29
PID 2276 wrote to memory of 2440	2276	NEW PURCHASE ORDER.png.exe	29
PID 2276 wrote to memory of 2440	2276	NEW PURCHASE ORDER.png.exe	29
PID 2276 wrote to memory of 2440	2276	NEW PURCHASE ORDER.png.exe	29
PID 2276 wrote to memory of 1988	2276	NEW PURCHASE ORDER.png.exe	31
PID 2276 wrote to memory of 1988	2276	NEW PURCHASE ORDER.png.exe	31
PID 2276 wrote to memory of 1988	2276	NEW PURCHASE ORDER.png.exe	31
PID 2276 wrote to memory of 1988	2276	NEW PURCHASE ORDER.png.exe	31
PID 2276 wrote to memory of 3044	2276	NEW PURCHASE ORDER.png.exe	32
PID 2276 wrote to memory of 3044	2276	NEW PURCHASE ORDER.png.exe	32
PID 2276 wrote to memory of 3044	2276	NEW PURCHASE ORDER.png.exe	32
PID 2276 wrote to memory of 3044	2276	NEW PURCHASE ORDER.png.exe	32
PID 2276 wrote to memory of 1776	2276	NEW PURCHASE ORDER.png.exe	35
PID 2276 wrote to memory of 1776	2276	NEW PURCHASE ORDER.png.exe	35
PID 2276 wrote to memory of 1776	2276	NEW PURCHASE ORDER.png.exe	35
PID 2276 wrote to memory of 1776	2276	NEW PURCHASE ORDER.png.exe	35
PID 2276 wrote to memory of 1776	2276	NEW PURCHASE ORDER.png.exe	35
PID 2276 wrote to memory of 1776	2276	NEW PURCHASE ORDER.png.exe	35
PID 2276 wrote to memory of 1776	2276	NEW PURCHASE ORDER.png.exe	35
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36
PID 2276 wrote to memory of 2496	2276	NEW PURCHASE ORDER.png.exe	36

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER.png.exe
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER.png.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER.png.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xoOiedqKhWYXR.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xoOiedqKhWYXR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpDD6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpDD6.tmp
Size 1KB
SHA256 0d6592816dac172f0c7735fda85089eecd821469f87026cdc55d4de9f4ad6c97
MD5 3139f74921e66cc468f178cc87d6fecb
SHA1 019ce4da2903d6681c8392c585eb9f664b217ef6
SHA512 6a9f3fdb242df920178b590219b5acf58d19e48569ff6887d67d37e73aa136b02cc0e1f887bf7925da6d98fc505fa2e870375f2fb332403882162ab19e2bebd1
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 c77f1300920a63401ba865958b03ba7f92b3e0f77f91a09f6985072256018788
MD5 8f9117bb25deb9ae22f26d111ea311e1
SHA1 eecc2c0dc08157745d51c862263670a7a717dd95
SHA512 3bdd234737096a278e695cb36a4e2b13d1114948ac5047fa919d2555c6d6dab5fd66f50292facdd54032b528bc46d3f878f9e4121b8717aa302c39836fa20802
SSDEEP 96:EJ2CJM8QknqvsqvJCwotJ2CJM8QknqvsEHyqvJCwor+3A6GkQHaZ7b3VkXlUVE:U/8kUo7/8kAHnoryok3Z7rVkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1988-45-0x000000006E7C0000-0x000000006ED6B000-memory.dmp

Download

memory/1988-21-0x000000006E7C0000-0x000000006ED6B000-memory.dmp

Download

memory/1988-26-0x000000006E7C0000-0x000000006ED6B000-memory.dmp

Download

memory/1988-23-0x00000000026E0000-0x0000000002720000-memory.dmp

Download

memory/1988-27-0x00000000026E0000-0x0000000002720000-memory.dmp

Download

memory/2276-6-0x0000000005960000-0x00000000059E4000-memory.dmp

Download

memory/2276-2-0x0000000000E50000-0x0000000000E90000-memory.dmp

Download

memory/2276-1-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Download

memory/2276-20-0x0000000000E50000-0x0000000000E90000-memory.dmp

Download

memory/2276-7-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Download

memory/2276-3-0x00000000009D0000-0x00000000009EC000-memory.dmp

Download

memory/2276-5-0x0000000000590000-0x00000000005A2000-memory.dmp

Download

memory/2276-39-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Download

memory/2276-4-0x00000000003A0000-0x00000000003AC000-memory.dmp

Download

memory/2276-0-0x00000000013D0000-0x000000000147C000-memory.dmp

Download

memory/2440-24-0x000000006E7C0000-0x000000006ED6B000-memory.dmp

Download

memory/2440-22-0x000000006E7C0000-0x000000006ED6B000-memory.dmp

Download

memory/2440-46-0x000000006E7C0000-0x000000006ED6B000-memory.dmp

Download

memory/2496-40-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2496-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2496-37-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2496-25-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2496-29-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2496-42-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2496-43-0x00000000739F0000-0x00000000740DE000-memory.dmp

Download

memory/2496-44-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Download

memory/2496-31-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2496-33-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2496-48-0x00000000739F0000-0x00000000740DE000-memory.dmp

Download

memory/2496-49-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Download