agenttesla | 9f3330ef95e0cb6c1926d216d4a4662cd1c9265f3559ee8121a39bdcc2e957bd

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/03/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
orklOX95inNBEJk.exe
Size 657KB
Sample240304-slqeradd21
SHA256 9f3330ef95e0cb6c1926d216d4a4662cd1c9265f3559ee8121a39bdcc2e957bd
MD5 f3efcd5366e2b5843f89b0b40900f8a5
SHA1 49655f9a1e12bc4a52f3b256432968fb17c2114c
SHA512 345fc5c6f167104679d15ada6aa4ab838348ff62385da15f78bfc1bfc48e7d4bead198439c09f24a090114c677dd39a584fdcb13712f3c68e4a75d8b58df84f7
SSDEEP 12288:AaLGDijUilDOY8Jax+Jmx0kLbNwyn1RzVW3rclxxjqZzqH4:AaKDiITYZKgh7jZW3QKO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
sg2plcpnl0128.prod.sin2.secureserver.net
Port
587
Username
[email protected]
Password
]EMe[F7b^j@[
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 1820	2380	orklOX95inNBEJk.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2380	orklOX95inNBEJk.exe
2380	orklOX95inNBEJk.exe
2380	orklOX95inNBEJk.exe
2380	orklOX95inNBEJk.exe
2380	orklOX95inNBEJk.exe
2632	powershell.exe
2536	powershell.exe
1820	RegSvcs.exe
1820	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	orklOX95inNBEJk.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	1820	RegSvcs.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2632	2380	orklOX95inNBEJk.exe	28
PID 2380 wrote to memory of 2632	2380	orklOX95inNBEJk.exe	28
PID 2380 wrote to memory of 2632	2380	orklOX95inNBEJk.exe	28
PID 2380 wrote to memory of 2632	2380	orklOX95inNBEJk.exe	28
PID 2380 wrote to memory of 2536	2380	orklOX95inNBEJk.exe	30
PID 2380 wrote to memory of 2536	2380	orklOX95inNBEJk.exe	30
PID 2380 wrote to memory of 2536	2380	orklOX95inNBEJk.exe	30
PID 2380 wrote to memory of 2536	2380	orklOX95inNBEJk.exe	30
PID 2380 wrote to memory of 2660	2380	orklOX95inNBEJk.exe	32
PID 2380 wrote to memory of 2660	2380	orklOX95inNBEJk.exe	32
PID 2380 wrote to memory of 2660	2380	orklOX95inNBEJk.exe	32
PID 2380 wrote to memory of 2660	2380	orklOX95inNBEJk.exe	32
PID 2380 wrote to memory of 2400	2380	orklOX95inNBEJk.exe	34
PID 2380 wrote to memory of 2400	2380	orklOX95inNBEJk.exe	34
PID 2380 wrote to memory of 2400	2380	orklOX95inNBEJk.exe	34
PID 2380 wrote to memory of 2400	2380	orklOX95inNBEJk.exe	34
PID 2380 wrote to memory of 2400	2380	orklOX95inNBEJk.exe	34
PID 2380 wrote to memory of 2400	2380	orklOX95inNBEJk.exe	34
PID 2380 wrote to memory of 2400	2380	orklOX95inNBEJk.exe	34
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35
PID 2380 wrote to memory of 1820	2380	orklOX95inNBEJk.exe	35

C:\Users\Admin\AppData\Local\Temp\orklOX95inNBEJk.exe
"C:\Users\Admin\AppData\Local\Temp\orklOX95inNBEJk.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\orklOX95inNBEJk.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LtUBQlmk.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LtUBQlmk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F6D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7F6D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp7F6D.tmp
Size 1KB
SHA256 a1d174eb5664382b12b963c25d5ca1a106d8ec21f47c082f8243cf29591ec2a8
MD5 c12c1a78a306b63b3b86f96d3a6346c4
SHA1 03b2c39df0495e47cc5a880db7e15d1b6dd4d881
SHA512 b9fa2cf1849e52be284c14456ef6c98880373da52ea15e5e808cfad1fb1fcd3fc68504a80e0551b3848955ea312cc6861d143d4ccea23e6c67ad1d1d935addce
MD5 SHA1 SHA512

Submit Download

DNJWMORDWADTLPML30ZI.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DNJWMORDWADTLPML30ZI.temp
Size 7KB
SHA256 d4e5b8efe7f562d26620eb1c98e4c8a2bd42cea9b9d4b87b197a1ced2ae5f156
MD5 08bdd627a43b982c2fd491a955e3c088
SHA1 c01dae20da2defcb502d071f80e091b062872972
SHA512 a671650a8177b3558fc957cdda21938fe0fe5818eb49c369bf0d38bd1814f72b671fd2c0d23d545d1f9e3656d81ce623c28a90c3bd173337999b0438078b64ef
SSDEEP 96:UlyCBM8jnqvsqvJCwoJlyCBM8jnqvsEHyqvJCworbtPf8QHLM76BXlUVA:wDXUoTDXAHnorbm+M76B7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1820-26-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1820-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1820-44-0x0000000004B30000-0x0000000004B70000-memory.dmp

Download

memory/1820-43-0x0000000073910000-0x0000000073FFE000-memory.dmp

Download

memory/1820-40-0x0000000004B30000-0x0000000004B70000-memory.dmp

Download

memory/1820-39-0x0000000073910000-0x0000000073FFE000-memory.dmp

Download

memory/1820-38-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1820-30-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1820-33-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1820-25-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1820-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1820-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2380-1-0x0000000074C10000-0x00000000752FE000-memory.dmp

Download

memory/2380-6-0x00000000053D0000-0x0000000005452000-memory.dmp

Download

memory/2380-4-0x0000000000300000-0x000000000030A000-memory.dmp

Download

memory/2380-5-0x0000000000310000-0x000000000031E000-memory.dmp

Download

memory/2380-37-0x0000000074C10000-0x00000000752FE000-memory.dmp

Download

memory/2380-2-0x00000000006E0000-0x0000000000720000-memory.dmp

Download

memory/2380-32-0x0000000074C10000-0x00000000752FE000-memory.dmp

Download

memory/2380-3-0x00000000002A0000-0x00000000002B6000-memory.dmp

Download

memory/2380-0-0x0000000000130000-0x00000000001D8000-memory.dmp

Download

memory/2536-21-0x00000000003F0000-0x0000000000430000-memory.dmp

Download

memory/2536-34-0x00000000003F0000-0x0000000000430000-memory.dmp

Download

memory/2536-41-0x000000006F280000-0x000000006F82B000-memory.dmp

Download

memory/2536-20-0x000000006F280000-0x000000006F82B000-memory.dmp

Download

memory/2632-22-0x000000006F280000-0x000000006F82B000-memory.dmp

Download

memory/2632-36-0x0000000002550000-0x0000000002590000-memory.dmp

Download

memory/2632-19-0x000000006F280000-0x000000006F82B000-memory.dmp

Download

memory/2632-42-0x000000006F280000-0x000000006F82B000-memory.dmp

Download

memory/2632-28-0x0000000002550000-0x0000000002590000-memory.dmp

Download