agenttesla | 0ab7b1d8cbcae94f3609db67caaacaa8fd58ddb59a84801606be7d2b7187fd3d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/04/2024, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation 15630509627.exe
Size 660KB
Sample240403-p7phssdg87
SHA256 0ab7b1d8cbcae94f3609db67caaacaa8fd58ddb59a84801606be7d2b7187fd3d
MD5 7a27f42e4e8cfa2084eb497685cd2c87
SHA1 2b1cbd655f35a4a88fd6dcc5854d500eaffc969c
SHA512 61031cacfee6c148e52be8eb1d4fd027b9952f4efd8f7c6f1df6e0f5b083c5087a370d00a68b490c28aeef113f064041cfa3c934b0c00d5e987d0fd63c16f91c
SSDEEP 12288:Ki0YOwqo8BfUioGTGTPP7myIzdZY+Ggek+AVRme0y42osWf6UiT:pO7o8GpGTSDmE+zInsL/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.oceanskylogistics.in
Port
587
Username
[email protected]
Password
Oce@n@1234
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\JLfew = "C:\\Users\\Admin\\AppData\\Roaming\\JLfew\\JLfew.exe"	Quotation 15630509627.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 2356	2808	Quotation 15630509627.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2808	Quotation 15630509627.exe
2808	Quotation 15630509627.exe
2356	Quotation 15630509627.exe
2356	Quotation 15630509627.exe
2488	powershell.exe
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	Quotation 15630509627.exe
Token: SeDebugPrivilege	2356	Quotation 15630509627.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2128	2808	Quotation 15630509627.exe	28
PID 2808 wrote to memory of 2128	2808	Quotation 15630509627.exe	28
PID 2808 wrote to memory of 2128	2808	Quotation 15630509627.exe	28
PID 2808 wrote to memory of 2128	2808	Quotation 15630509627.exe	28
PID 2808 wrote to memory of 2488	2808	Quotation 15630509627.exe	30
PID 2808 wrote to memory of 2488	2808	Quotation 15630509627.exe	30
PID 2808 wrote to memory of 2488	2808	Quotation 15630509627.exe	30
PID 2808 wrote to memory of 2488	2808	Quotation 15630509627.exe	30
PID 2808 wrote to memory of 2612	2808	Quotation 15630509627.exe	32
PID 2808 wrote to memory of 2612	2808	Quotation 15630509627.exe	32
PID 2808 wrote to memory of 2612	2808	Quotation 15630509627.exe	32
PID 2808 wrote to memory of 2612	2808	Quotation 15630509627.exe	32
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34
PID 2808 wrote to memory of 2356	2808	Quotation 15630509627.exe	34

C:\Users\Admin\AppData\Local\Temp\Quotation 15630509627.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation 15630509627.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Quotation 15630509627.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AwERaWeh.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AwERaWeh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA82.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\Quotation 15630509627.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation 15630509627.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpAA82.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpAA82.tmp
Size 1KB
SHA256 fe27147800c87aa54799b4db59af0382612f054e1b68ea1f213fd81becbf2f40
MD5 b114c4f8b2d71a7571a871c96d6fac33
SHA1 3b943a5e2a22bd61234722703312cb8c0f593e45
SHA512 1a655015e5756dd8cce5b890eb90de6a9352fedb90fa488a932bb0d3452090c922cdd73ba14390a2350fc05ecd944336777b4b729c4a5da5e366ef072f8984c6
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 dbb68393acb2691256592bbbc515189bc8b8a7131b8fce9d8377ec592c318eed
MD5 8dfef8e5636e1137fbbc579b8bbbb233
SHA1 675eb8a2334c9090ff25989a7af79772690df070
SHA512 e6e8641c792c9e00c005379014a45b44af32bc6453f77761484265486b2bd634fb8a939039000c13464bab07f8778b55e922adf4a3d4a73102768d80b1155e85
SSDEEP 96:oVuCpM8GnqvsqvJCwoXVuCpM8GnqvsEHyqvJCworJxoViQHxA7u4XlUVu:MHqUoFHqAHnorJPoA7u4R
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2128-34-0x0000000002550000-0x0000000002590000-memory.dmp

Download

memory/2128-32-0x000000006F110000-0x000000006F6BB000-memory.dmp

Download

memory/2128-43-0x000000006F110000-0x000000006F6BB000-memory.dmp

Download

memory/2128-42-0x0000000002550000-0x0000000002590000-memory.dmp

Download

memory/2128-36-0x000000006F110000-0x000000006F6BB000-memory.dmp

Download

memory/2356-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2356-40-0x0000000072F80000-0x000000007366E000-memory.dmp

Download

memory/2356-20-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2356-22-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2356-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2356-26-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2356-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2356-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2356-30-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2356-38-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Download

memory/2356-46-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Download

memory/2356-47-0x0000000072F80000-0x000000007366E000-memory.dmp

Download

memory/2488-39-0x0000000002450000-0x0000000002490000-memory.dmp

Download

memory/2488-35-0x000000006F110000-0x000000006F6BB000-memory.dmp

Download

memory/2488-33-0x000000006F110000-0x000000006F6BB000-memory.dmp

Download

memory/2488-37-0x0000000002450000-0x0000000002490000-memory.dmp

Download

memory/2488-41-0x0000000002450000-0x0000000002490000-memory.dmp

Download

memory/2488-44-0x000000006F110000-0x000000006F6BB000-memory.dmp

Download

memory/2808-31-0x0000000074280000-0x000000007496E000-memory.dmp

Download

memory/2808-1-0x0000000074280000-0x000000007496E000-memory.dmp

Download

memory/2808-5-0x00000000054A0000-0x0000000005524000-memory.dmp

Download

memory/2808-4-0x0000000000360000-0x000000000036C000-memory.dmp

Download

memory/2808-3-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2808-2-0x0000000004D10000-0x0000000004D50000-memory.dmp

Download

memory/2808-0-0x0000000000D70000-0x0000000000E1A000-memory.dmp

Download