agenttesla | e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
Size

841KB
MD5

06f57237f5afe9a1eb6c3ac80d7afbbe
SHA1

fd3b13b89ef9cb8e257760e7c666f4f984f9212c
SHA256

e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d
SHA512

4e3f2b2d5260bed888fc4be76c082a7c7336a53ce549a408275c14f517720317b70903ce428c4fc9840ff4688f54bff89faae3311f234053e29cfadb1b763ba2
SSDEEP

12288:NCsLBMhHwgG35oRJaq8bxAIR6gneRtvkt6qVwfO+Kw1j8GhU6a6zahQ770uSekR:Co5yQxAKeRGw2+KjGaKy64t

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
okmabejemqjzazob
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 6 IoCs

resource	yara_rule
behavioral1/memory/2560-25-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2560-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2560-37-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2560-40-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2560-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2560-49-0x0000000001200000-0x0000000001240000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs

resource	yara_rule
behavioral1/memory/2560-25-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2560-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2560-37-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2560-40-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2560-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2560-49-0x0000000001200000-0x0000000001240000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 6 IoCs

resource	yara_rule
behavioral1/memory/2560-25-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2560-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2560-37-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2560-40-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2560-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2560-49-0x0000000001200000-0x0000000001240000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/memory/2752-3-0x00000000004D0000-0x00000000004E2000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects executables referencing Windows vault credential objects. Observed in infostealers 6 IoCs

resource	yara_rule
behavioral1/memory/2560-25-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2560-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2560-37-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2560-40-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2560-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2560-49-0x0000000001200000-0x0000000001240000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2560-25-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2560-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2560-37-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2560-40-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2560-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2560-49-0x0000000001200000-0x0000000001240000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2560-25-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2560-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2560-37-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2560-40-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2560-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2560-49-0x0000000001200000-0x0000000001240000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2560-25-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2560-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2560-37-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2560-40-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2560-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2560-49-0x0000000001200000-0x0000000001240000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2752 set thread context of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
2636	powershell.exe
2384	powershell.exe
2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
2560	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
2560	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2560	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2560	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2384	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	28
PID 2752 wrote to memory of 2384	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	28
PID 2752 wrote to memory of 2384	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	28
PID 2752 wrote to memory of 2384	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	28
PID 2752 wrote to memory of 2636	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	30
PID 2752 wrote to memory of 2636	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	30
PID 2752 wrote to memory of 2636	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	30
PID 2752 wrote to memory of 2636	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	30
PID 2752 wrote to memory of 2712	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	32
PID 2752 wrote to memory of 2712	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	32
PID 2752 wrote to memory of 2712	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	32
PID 2752 wrote to memory of 2712	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	32
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34
PID 2752 wrote to memory of 2560	2752	e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe	34

C:\Users\Admin\AppData\Local\Temp\e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
"C:\Users\Admin\AppData\Local\Temp\e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RRZvfrjwRHkx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RRZvfrjwRHkx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FF4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe
  "C:\Users\Admin\AppData\Local\Temp\e9ea79b9129140cbc495137ea1c09c0686d5a5d33c43cfd1217ee2aead41237d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4FF4.tmp

Filesize
1KB

MD5
d3b5505d1f71ed91ac5f681de6df85d1

SHA1
f0ccd5222dd99d3974699906000cc77f2a8fbd26

SHA256
4d28c6e029c266e39f4db35d6ef47bd1fedafa2b2bcb2467481207e903352b53

SHA512
ec9dbe3d1d37783aa294973fa9eda01ac9dfdc5cb33d192e24111acba5f890b7b4014536fa2e6ab5517886454c2ea26c1bec5b0180f7ccca91f184588d7983a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
d29fe0f6b9f1f60445594ae9d465e70b

SHA1
bff0a090faa45c5e62cd6c769d47d76563471f56

SHA256
f9e69408fa4f48a623448a595c5d6e6d8957cf89e591fd2b72c4f5332a381a53

SHA512
af294b45fe73b2faf3138830fdbcc89f95a1191ceb5c13d2c0999d1ec8b32f047189a0a0889dfcb4170c6c1f9174c607f37a04245f22efb6c9e1a69680917da1

Download Submit
memory/2384-22-0x000000006DDA0000-0x000000006E34B000-memory.dmp

Filesize
5.7MB

Download
memory/2384-46-0x000000006DDA0000-0x000000006E34B000-memory.dmp

Filesize
5.7MB

Download
memory/2384-36-0x0000000002CF0000-0x0000000002D30000-memory.dmp

Filesize
256KB

Download
memory/2384-30-0x0000000002CF0000-0x0000000002D30000-memory.dmp

Filesize
256KB

Download
memory/2384-28-0x000000006DDA0000-0x000000006E34B000-memory.dmp

Filesize
5.7MB

Download
memory/2384-24-0x0000000002CF0000-0x0000000002D30000-memory.dmp

Filesize
256KB

Download
memory/2560-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2560-45-0x0000000001200000-0x0000000001240000-memory.dmp

Filesize
256KB

Download
memory/2560-49-0x0000000001200000-0x0000000001240000-memory.dmp

Filesize
256KB

Download
memory/2560-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2560-48-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-42-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2560-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2560-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2560-37-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2560-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2560-44-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2636-34-0x0000000002B90000-0x0000000002BD0000-memory.dmp

Filesize
256KB

Download
memory/2636-32-0x0000000002B90000-0x0000000002BD0000-memory.dmp

Filesize
256KB

Download
memory/2636-47-0x000000006DDA0000-0x000000006E34B000-memory.dmp

Filesize
5.7MB

Download
memory/2636-38-0x0000000002B90000-0x0000000002BD0000-memory.dmp

Filesize
256KB

Download
memory/2636-20-0x000000006DDA0000-0x000000006E34B000-memory.dmp

Filesize
5.7MB

Download
memory/2636-26-0x000000006DDA0000-0x000000006E34B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-4-0x0000000000600000-0x000000000060E000-memory.dmp

Filesize
56KB

Download
memory/2752-43-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-2-0x0000000004C10000-0x0000000004C50000-memory.dmp

Filesize
256KB

Download
memory/2752-3-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2752-1-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-5-0x0000000004CB0000-0x0000000004D4C000-memory.dmp

Filesize
624KB

Download
memory/2752-0-0x00000000013A0000-0x0000000001474000-memory.dmp

Filesize
848KB

Download