agenttesla | fb3d82bb5d2ea0c9636a4d2eb6137cee81026f4b348eef7c9d269cbc346d1521

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order.pif.exe
Size 700KB
Sample240229-ldly2ace3z
SHA256 fb3d82bb5d2ea0c9636a4d2eb6137cee81026f4b348eef7c9d269cbc346d1521
MD5 147240336f98a7fc1f2062c57816a27d
SHA1 483d614d7586bacfefe2b8b226f22ab056682d16
SHA512 0d78df31bc774077efa876f0f2641037f4900fcb100a42d03f7e549192dbdb4814d749a3b0bbfa81cf32561cbbeabc8c2b3dc2cc0ad029cbff8e9ae95e466a16
SSDEEP 12288:0zNwnqs3y44sAGk0fGQGCSqrPzOny+qTGU3ajf5HkD8Zm4tAN92fXoqq3AjLc8AY:pnPAGk0fl3FPzOBqTGjjxED83tqcAA30
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://5.255.100.203
Port
21
Username
[email protected]
Password
StillsomaOr#

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 2440	3064	New Order.pif.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3064	New Order.pif.exe
3064	New Order.pif.exe
2628	powershell.exe
2552	powershell.exe
3064	New Order.pif.exe
2440	New Order.pif.exe
2440	New Order.pif.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	New Order.pif.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2440	New Order.pif.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2628	3064	New Order.pif.exe	28
PID 3064 wrote to memory of 2628	3064	New Order.pif.exe	28
PID 3064 wrote to memory of 2628	3064	New Order.pif.exe	28
PID 3064 wrote to memory of 2628	3064	New Order.pif.exe	28
PID 3064 wrote to memory of 2552	3064	New Order.pif.exe	30
PID 3064 wrote to memory of 2552	3064	New Order.pif.exe	30
PID 3064 wrote to memory of 2552	3064	New Order.pif.exe	30
PID 3064 wrote to memory of 2552	3064	New Order.pif.exe	30
PID 3064 wrote to memory of 2540	3064	New Order.pif.exe	32
PID 3064 wrote to memory of 2540	3064	New Order.pif.exe	32
PID 3064 wrote to memory of 2540	3064	New Order.pif.exe	32
PID 3064 wrote to memory of 2540	3064	New Order.pif.exe	32
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34
PID 3064 wrote to memory of 2440	3064	New Order.pif.exe	34

C:\Users\Admin\AppData\Local\Temp\New Order.pif.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.pif.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\New Order.pif.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WcxjugOFodG.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WcxjugOFodG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AA0.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\New Order.pif.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order.pif.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3AA0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3AA0.tmp
Size 1KB
SHA256 4b7270eae39695b55e3592b2c765868c60381c31c9b82b6c3ff54611fd6ba844
MD5 519dc1e97f27971b77c230ca3fb47923
SHA1 c3115e419445dc345c879e5385091e190dde1385
SHA512 2375771b223a1fdc360c62938a0a5f9a7840d152639d263db091bf2d9f3318608721a16066009f3069884caf0073b9a4b71265f3d0530a4e6edc52f67973f2ce
MD5 SHA1 SHA512

Submit Download

1CNUR5BR4FL7PRPXVR7K.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1CNUR5BR4FL7PRPXVR7K.temp
Size 7KB
SHA256 a46601e2f1ebaadf90baccd0d23cb0bd222ce042457bb68056392070534294e3
MD5 41886d46016d71d4b6a6c94a883133b3
SHA1 aced6abafab8a45884f163ca5dd62bf0d137f9f1
SHA512 850094c93ed06b4ed8684196840bd81bd8dedd3a2242518963efc61d22ff5cf1110956557fa9f1699824f9ba6488f9b2fc756f87d396d4cb356e57d25937aa5d
SSDEEP 96:led0PCBM8FnqvsqvJCwoied0PCBM8FnqvsEHyqvJCworqP+wJQHlzHEz7RPIXlUk:8005Uol005AHnorqPfYzkz7RPIx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2440-22-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2440-37-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Download

memory/2440-36-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2440-34-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2440-31-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2440-41-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Download

memory/2440-42-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Download

memory/2440-19-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2440-24-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2440-20-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2440-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2552-27-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Download

memory/2552-21-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Download

memory/2552-28-0x00000000003F0000-0x0000000000430000-memory.dmp

Download

memory/2552-40-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Download

memory/2628-39-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Download

memory/2628-23-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Download

memory/2628-30-0x00000000002D0000-0x0000000000310000-memory.dmp

Download

memory/2628-33-0x00000000002D0000-0x0000000000310000-memory.dmp

Download

memory/2628-25-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Download

memory/3064-6-0x00000000059A0000-0x0000000005A22000-memory.dmp

Download

memory/3064-5-0x00000000004C0000-0x00000000004D2000-memory.dmp

Download

memory/3064-4-0x0000000000590000-0x000000000059C000-memory.dmp

Download

memory/3064-3-0x00000000006A0000-0x00000000006BC000-memory.dmp

Download

memory/3064-38-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Download

memory/3064-1-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Download

memory/3064-2-0x00000000020C0000-0x0000000002100000-memory.dmp

Download

memory/3064-0-0x0000000000080000-0x0000000000136000-memory.dmp

Download