agenttesla | 4aa54ba48da2003e48cfa642af6e062b685ca903b235418faf39932a5ab08045

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order quotation.exe
Size 668KB
Sample240321-mpdbpsba9w
SHA256 4aa54ba48da2003e48cfa642af6e062b685ca903b235418faf39932a5ab08045
MD5 25578066eeebdce0aae71546e55c8af2
SHA1 1f23bfea9b5842e243d9ad9dede31533386e20ab
SHA512 60b26abd07373c6ca09d6056897f64c041c441eb5378994cb4769d7d65c653e5107461a06899b2fbb79e8472633a1a5f10fcc0a6fc6e74343e8b1c6adfa95ec8
SSDEEP 12288:LU0KoFwwikURzlOy7PS19AQrzhS63/iezVxLFOLsHST9UIUkkN1:LzKoRikw9219JHhFbV/usyBlZI1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
phoenixblowers.com
Port
587
Username
[email protected]
Password
Officeback@2022#
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 2652	2824	Order quotation.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2072	powershell.exe
3024	powershell.exe
2652	RegSvcs.exe
2652	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2652	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2072	2824	Order quotation.exe	28
PID 2824 wrote to memory of 2072	2824	Order quotation.exe	28
PID 2824 wrote to memory of 2072	2824	Order quotation.exe	28
PID 2824 wrote to memory of 2072	2824	Order quotation.exe	28
PID 2824 wrote to memory of 3024	2824	Order quotation.exe	30
PID 2824 wrote to memory of 3024	2824	Order quotation.exe	30
PID 2824 wrote to memory of 3024	2824	Order quotation.exe	30
PID 2824 wrote to memory of 3024	2824	Order quotation.exe	30
PID 2824 wrote to memory of 2516	2824	Order quotation.exe	32
PID 2824 wrote to memory of 2516	2824	Order quotation.exe	32
PID 2824 wrote to memory of 2516	2824	Order quotation.exe	32
PID 2824 wrote to memory of 2516	2824	Order quotation.exe	32
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34
PID 2824 wrote to memory of 2652	2824	Order quotation.exe	34

C:\Users\Admin\AppData\Local\Temp\Order quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Order quotation.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Order quotation.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eusPqT.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eusPqT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3FAF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3FAF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3FAF.tmp
Size 1KB
SHA256 b33b1a58e85da8dd320cb6570fe47ecba2743a6cd32eb485b67d9f65b4776dee
MD5 34b8aeb5e08f5d6b660ce3a2f2d5f831
SHA1 eb165a9f391d72134ae65c0f599076f522a53830
SHA512 796872380b4a7d6e9dea6891f05f9f26edb03559cfaa976a004db5260852a5730b751047acfd758e8801aa32521b4d316f3fc9d4b9335cd3b80273bffc9ae6a5
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 b062e01c909d14c8996bed5449982457bd5ed9a067a1207adc73deafeb32f626
MD5 73ed9958eb0c7deccb32f9210e6b6423
SHA1 de01696da1caa45f98b0a865bd535bf8a265d896
SHA512 1d54c6c581a236b0439bf8c11cff30abbff11c64fcee9e2fdbfa8c737c2e79d5c336060541830fd4f371f91ef99dc5f0b9068804d5d8cb69509231e06fd9e2a5
SSDEEP 96:0qAFwCaIM8rnqvsqvJCwowqAFwCaIM8rnqvsEHyqvJCworHcUDQHZz/z7TYXlUVb:rAFhXUoHAFhXAHnorHror7TYg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2072-44-0x000000006F170000-0x000000006F71B000-memory.dmp

Download

memory/2072-32-0x0000000002E90000-0x0000000002ED0000-memory.dmp

Download

memory/2072-25-0x000000006F170000-0x000000006F71B000-memory.dmp

Download

memory/2072-22-0x0000000002E90000-0x0000000002ED0000-memory.dmp

Download

memory/2072-21-0x000000006F170000-0x000000006F71B000-memory.dmp

Download

memory/2652-38-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2652-41-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download

memory/2652-46-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Download

memory/2652-45-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download

memory/2652-42-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Download

memory/2652-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2652-40-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2652-35-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2652-29-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2652-20-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2652-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2652-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2824-4-0x0000000000460000-0x0000000000468000-memory.dmp

Download

memory/2824-2-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/2824-5-0x0000000000480000-0x000000000048C000-memory.dmp

Download

memory/2824-1-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download

memory/2824-37-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download

memory/2824-0-0x0000000000130000-0x00000000001DC000-memory.dmp

Download

memory/2824-3-0x0000000000430000-0x0000000000446000-memory.dmp

Download

memory/2824-6-0x0000000005300000-0x0000000005382000-memory.dmp

Download

memory/3024-27-0x000000006F170000-0x000000006F71B000-memory.dmp

Download

memory/3024-43-0x000000006F170000-0x000000006F71B000-memory.dmp

Download

memory/3024-28-0x0000000002D80000-0x0000000002DC0000-memory.dmp

Download

memory/3024-30-0x0000000002D80000-0x0000000002DC0000-memory.dmp

Download

memory/3024-19-0x000000006F170000-0x000000006F71B000-memory.dmp

Download