agenttesla | aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe
Size

563KB
MD5

9e0163eaf2a07786bc822ac32d42588b
SHA1

8fae6007b41ef2474f1ae6cedca7da5b62d7dcba
SHA256

aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90
SHA512

3163d930c6b7445dc2fe214a8c80ab94ac6a0a8a07dd96104e8bb3d44017dd2e1cad9dbc00153db06bca118787add0522bc888e80d0dfc311a3a263bde11fa97
SSDEEP

12288:xYV6MorX7qzuC3QHO9FQVHPF51jgcMz3NMqX6kjRlQvXu99:GBXu9HGaVHM5VX3ovXub

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan upx

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.cash4cars.nz
Port:
587
Username:
[email protected]
Password:
logs2024!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs

resource	yara_rule
behavioral2/memory/3084-31-0x0000000000770000-0x00000000007B2000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/3084-31-0x0000000000770000-0x00000000007B2000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/memory/3084-31-0x0000000000770000-0x00000000007B2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/3084-31-0x0000000000770000-0x00000000007B2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/3084-31-0x0000000000770000-0x00000000007B2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/3084-31-0x0000000000770000-0x00000000007B2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/3084-31-0x0000000000770000-0x00000000007B2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/4660-0-0x0000000000790000-0x00000000008D7000-memory.dmp	UPX
behavioral2/files/0x0008000000023314-14.dat	UPX
behavioral2/memory/2428-15-0x00000000001B0000-0x00000000002F7000-memory.dmp	UPX
behavioral2/memory/4660-16-0x0000000000790000-0x00000000008D7000-memory.dmp	UPX
behavioral2/memory/2428-32-0x00000000001B0000-0x00000000002F7000-memory.dmp	UPX

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
2428	name.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4660-0-0x0000000000790000-0x00000000008D7000-memory.dmp	upx
behavioral2/files/0x0008000000023314-14.dat	upx
behavioral2/memory/2428-15-0x00000000001B0000-0x00000000002F7000-memory.dmp	upx
behavioral2/memory/4660-16-0x0000000000790000-0x00000000008D7000-memory.dmp	upx
behavioral2/memory/2428-32-0x00000000001B0000-0x00000000002F7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newfile = "C:\\Users\\Admin\\AppData\\Roaming\\newfile\\newfile.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4660-16-0x0000000000790000-0x00000000008D7000-memory.dmp	autoit_exe
behavioral2/memory/2428-32-0x00000000001B0000-0x00000000002F7000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2428 set thread context of 3084	2428	name.exe	101

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3084	RegSvcs.exe
3084	RegSvcs.exe
3084	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2428	name.exe
2428	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4660	aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe
4660	aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe
2428	name.exe
2428	name.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4660	aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe
4660	aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe
2428	name.exe
2428	name.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 2428	4660	aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe	100
PID 4660 wrote to memory of 2428	4660	aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe	100
PID 4660 wrote to memory of 2428	4660	aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe	100
PID 2428 wrote to memory of 3084	2428	name.exe	101
PID 2428 wrote to memory of 3084	2428	name.exe	101
PID 2428 wrote to memory of 3084	2428	name.exe	101
PID 2428 wrote to memory of 3084	2428	name.exe	101

C:\Users\Admin\AppData\Local\Temp\aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe
"C:\Users\Admin\AppData\Local\Temp\aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\aa1cb2bbf2d4c6fcbd633536c3113dabebd9405543d6325f583a3e7d39d76b90.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3548 --field-trial-handle=2264,i,7010714054498059916,1862725710331979271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\directory\name.exe

Filesize
108.5MB

MD5
7436e14fc803904774382c9f2a689084

SHA1
ae6abc8df33ad0b478d78b7ae656227cadb5c893

SHA256
27281d7b1d6f462577cf1da3abb4e4fbc74b774f97a903d4a26a5a2af09fb257

SHA512
0e992672fcd8628e503940d0e3c09ca5b8b65792edf87b77828a8a1dbeede3862110b755cbf62dcec9ca2aebc38c3b6bba1576f8e02ee5e8d9753add3baf7da0

Download Submit
memory/2428-32-0x00000000001B0000-0x00000000002F7000-memory.dmp

Filesize
1.3MB

Download
memory/2428-15-0x00000000001B0000-0x00000000002F7000-memory.dmp

Filesize
1.3MB

Download
memory/3084-38-0x00000000061F0000-0x0000000006240000-memory.dmp

Filesize
320KB

Download
memory/3084-31-0x0000000000770000-0x00000000007B2000-memory.dmp

Filesize
264KB

Download
memory/3084-33-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/3084-34-0x0000000005430000-0x00000000059D4000-memory.dmp

Filesize
5.6MB

Download
memory/3084-35-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download
memory/3084-36-0x0000000004EF0000-0x0000000004F56000-memory.dmp

Filesize
408KB

Download
memory/3084-39-0x00000000062E0000-0x0000000006372000-memory.dmp

Filesize
584KB

Download
memory/3084-40-0x0000000006270000-0x000000000627A000-memory.dmp

Filesize
40KB

Download
memory/3084-41-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/3084-42-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download
memory/4660-16-0x0000000000790000-0x00000000008D7000-memory.dmp

Filesize
1.3MB

Download
memory/4660-11-0x0000000001330000-0x0000000001334000-memory.dmp

Filesize
16KB

Download
memory/4660-0-0x0000000000790000-0x00000000008D7000-memory.dmp

Filesize
1.3MB

Download