agenttesla | f25fd991e42376de0f43137ce7756f37eed5e39a36ba8dfc2991ee962963a51a

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/04/2024, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PURCHASE ORDER.exe
Size 686KB
Sample240403-p7phssdd6w
SHA256 f25fd991e42376de0f43137ce7756f37eed5e39a36ba8dfc2991ee962963a51a
MD5 0a8adb7ca224de7da06b30e03fd99f8a
SHA1 289c3aaba5d1fe1967a3ff24fd49b1752db9429e
SHA512 b8ca6ee8ff8826fc4d5fd39920c019aa80e2c6d4c9ed0619efd0761346fa12a4c7057cef4e66e4e22c882f795c29c6b4705bd574719e4577afbd4de2ee7885ff
SSDEEP 12288:k8B0YOwq+pMJYM+U375U3Hz59aYLG7locbjsbvpxhw13KZWpiGdLeTAnj1aPzEKa:ZO7JsU37287lvXQvpDwpKEkee0nj0Pzh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.shivomrealty.com
Port
587
Username
[email protected]
Password
Priya1982#
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3056 set thread context of 2424	3056	PURCHASE ORDER.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3056	PURCHASE ORDER.exe
3056	PURCHASE ORDER.exe
2576	powershell.exe
2620	powershell.exe
3056	PURCHASE ORDER.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	PURCHASE ORDER.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2620	3056	PURCHASE ORDER.exe	28
PID 3056 wrote to memory of 2620	3056	PURCHASE ORDER.exe	28
PID 3056 wrote to memory of 2620	3056	PURCHASE ORDER.exe	28
PID 3056 wrote to memory of 2620	3056	PURCHASE ORDER.exe	28
PID 3056 wrote to memory of 2576	3056	PURCHASE ORDER.exe	30
PID 3056 wrote to memory of 2576	3056	PURCHASE ORDER.exe	30
PID 3056 wrote to memory of 2576	3056	PURCHASE ORDER.exe	30
PID 3056 wrote to memory of 2576	3056	PURCHASE ORDER.exe	30
PID 3056 wrote to memory of 2940	3056	PURCHASE ORDER.exe	32
PID 3056 wrote to memory of 2940	3056	PURCHASE ORDER.exe	32
PID 3056 wrote to memory of 2940	3056	PURCHASE ORDER.exe	32
PID 3056 wrote to memory of 2940	3056	PURCHASE ORDER.exe	32
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34
PID 3056 wrote to memory of 2424	3056	PURCHASE ORDER.exe	34

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\myJbYklINJJPS.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\myJbYklINJJPS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4200.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4200.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4200.tmp
Size 1KB
SHA256 0a7e27494a51d6b5c622fad58508afa3db2b442931df349a79915e9352e17b87
MD5 8b81d1d4debe6430ceb88d81ae4905f4
SHA1 1b4a03de86b411fb7510bcce70e20ac88724967a
SHA512 05db49edfb52d7d0b027ccacfd0f62545e8afd9059349316142b33072358726fedc9587781e4852d460076e16915f77563bc45ec9fd3ffa7e980568d46a8a3f0
MD5 SHA1 SHA512

Submit Download

JOANV2HA6TQXW5DF4C3R.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JOANV2HA6TQXW5DF4C3R.temp
Size 7KB
SHA256 270ed9d67461f2bc171723ec9e5cd77f861ba9e2c98ceeb35c2c08c61e6c926f
MD5 eb5f09d1494764bd33b63856c366f57e
SHA1 2346f657121d60db237c822e0b33f6370b495d1f
SHA512 95e0524ebe76cf437f5687404b3a2cbdcc78c054885e3fd786baf9ad012c6da0ae1cb7b23e856127a5c12526fff61d895026593093d70b9f0f6c9d4461cf1dbc
SSDEEP 96:led0PCBM87nqvsqvJCwoied0PCBM87nqvsEHyqvJCworqPKw3QHlzHEz7RPyXlUk:800HUol00HAHnorqPpYzkz7RPyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2424-19-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2424-20-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2424-22-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2424-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2424-29-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2424-32-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2424-18-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2576-28-0x00000000029C0000-0x0000000002A00000-memory.dmp

Download

memory/2576-35-0x000000006FA60000-0x000000007000B000-memory.dmp

Download

memory/2576-27-0x000000006FA60000-0x000000007000B000-memory.dmp

Download

memory/2576-21-0x000000006FA60000-0x000000007000B000-memory.dmp

Download

memory/2620-23-0x000000006FA60000-0x000000007000B000-memory.dmp

Download

memory/2620-25-0x000000006FA60000-0x000000007000B000-memory.dmp

Download

memory/2620-30-0x00000000020F0000-0x0000000002130000-memory.dmp

Download

memory/2620-36-0x000000006FA60000-0x000000007000B000-memory.dmp

Download

memory/3056-5-0x0000000005420000-0x00000000054A2000-memory.dmp

Download

memory/3056-1-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Download

memory/3056-3-0x00000000005A0000-0x00000000005BA000-memory.dmp

Download

memory/3056-2-0x00000000048D0000-0x0000000004910000-memory.dmp

Download

memory/3056-0-0x00000000010B0000-0x0000000001162000-memory.dmp

Download

memory/3056-4-0x00000000007D0000-0x00000000007DC000-memory.dmp

Download

memory/3056-33-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Download