agenttesla | a84ee8232f5a37ae4a468c0e71f52869fdd445384c42556b1a5b15880522aafa

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240328transaction-copy Pdf.exe
Size

617KB
MD5

a1cfc0e1471ab03ae805282abbb771ef
SHA1

02401a46af1d3e062c483bbc12573652701b9081
SHA256

a84ee8232f5a37ae4a468c0e71f52869fdd445384c42556b1a5b15880522aafa
SHA512

5fde35a22351b8a4adb2019ce865fe55d8337db9bcc0bbf63e06935f5ea07d57c1d3dca0674862409d63f81cd104272684567ef1b5cde54e2b2d17c1cc6b9ada
SSDEEP

12288:r94XSqqHmms9jgqal8V2YsI+DItbJT6CDvSVG6CI6yo1VQagZ:r94XSqqHm1al84ZDItdnqGJI/o1VgZ

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Sl!KOtF7
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZUHFqcY = "C:\\Users\\Admin\\AppData\\Roaming\\ZUHFqcY\\ZUHFqcY.exe"	regsvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

20240328transaction-copy Pdf.exe

description pid process target process

PID 4744 set thread context of 3244 4744 20240328transaction-copy Pdf.exe regsvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4616 3244 WerFault.exe regsvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvcs.exe

pid process

3244 regsvcs.exe
3244 regsvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

regsvcs.exe

description pid process

Token: SeDebugPrivilege 3244 regsvcs.exe

flow	ioc
24	ip-api.com

description	pid	process	target process
PID 4744 set thread context of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe

pid	pid_target	process	target process
4616	3244	WerFault.exe	regsvcs.exe

pid	process
3244	regsvcs.exe
3244	regsvcs.exe

description	pid	process
Token: SeDebugPrivilege	3244	regsvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

20240328transaction-copy Pdf.exe

description	pid	process	target process
PID 4744 wrote to memory of 1044	4744	20240328transaction-copy Pdf.exe	installutil.exe
PID 4744 wrote to memory of 1044	4744	20240328transaction-copy Pdf.exe	installutil.exe
PID 4744 wrote to memory of 1044	4744	20240328transaction-copy Pdf.exe	installutil.exe
PID 4744 wrote to memory of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe
PID 4744 wrote to memory of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe
PID 4744 wrote to memory of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe
PID 4744 wrote to memory of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe
PID 4744 wrote to memory of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe
PID 4744 wrote to memory of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe
PID 4744 wrote to memory of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe
PID 4744 wrote to memory of 3244	4744	20240328transaction-copy Pdf.exe	regsvcs.exe

C:\Users\Admin\AppData\Local\Temp\20240328transaction-copy Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\20240328transaction-copy Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
PID:1044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 1872
3⤵
- Program crash
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3244 -ip 3244
1⤵
PID:2616

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3244-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3244-5-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/3244-6-0x0000000005AF0000-0x0000000006094000-memory.dmp

Filesize
5.6MB

Download
memory/3244-7-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/3244-8-0x00000000056B0000-0x0000000005716000-memory.dmp

Filesize
408KB

Download
memory/3244-11-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-0-0x0000020FBF430000-0x0000020FBF43C000-memory.dmp

Filesize
48KB

Download
memory/4744-1-0x00007FFDE75F0000-0x00007FFDE80B1000-memory.dmp

Filesize
10.8MB

Download
memory/4744-2-0x0000020FC1120000-0x0000020FC1130000-memory.dmp

Filesize
64KB

Download
memory/4744-3-0x0000020FDA790000-0x0000020FDA826000-memory.dmp

Filesize
600KB

Download
memory/4744-9-0x00007FFDE75F0000-0x00007FFDE80B1000-memory.dmp

Filesize
10.8MB

Download