agenttesla | 72fdee6bbb20fd83e38e2d73518e2deeddb1fdf687a801703ba0b2b2f0b0475d

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/04/2024, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Draft Invoice.exe
Size 630KB
Sample240413-tbmfsaef44
SHA256 615f457d36ad1da20bd802ff15975732d9ebe71f5b4d540ef19c5ca3135fd863
MD5 eb0f59239e7511ffa5ad81468163ad68
SHA1 70529b6039cc5ea7346bd055519d2f6eb2136ed6
SHA512 bb4f641f469277a512563c37af1a21286322b225b06e867a6ede93b49f33a155a2362a7a3d1c3f9470506702aa919bffbdf6b82a93b12e17a723a8b08fdf401d
SSDEEP 12288:Skvq31eoWKzKRXwMf/MNbTym7deYAedEWp1+lP6SdxjjFGY:SeqFmRXwFNvH8YjJp1+lySnjp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.weeecoiq.com
Port
587
Username
[email protected]
Password
erT8BI2W0w
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 2712	2176	Draft Invoice.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2176	Draft Invoice.exe
2176	Draft Invoice.exe
2712	Draft Invoice.exe
2712	Draft Invoice.exe
2564	powershell.exe
1900	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	Draft Invoice.exe
Token: SeDebugPrivilege	2712	Draft Invoice.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1900	2176	Draft Invoice.exe	28
PID 2176 wrote to memory of 1900	2176	Draft Invoice.exe	28
PID 2176 wrote to memory of 1900	2176	Draft Invoice.exe	28
PID 2176 wrote to memory of 1900	2176	Draft Invoice.exe	28
PID 2176 wrote to memory of 2564	2176	Draft Invoice.exe	30
PID 2176 wrote to memory of 2564	2176	Draft Invoice.exe	30
PID 2176 wrote to memory of 2564	2176	Draft Invoice.exe	30
PID 2176 wrote to memory of 2564	2176	Draft Invoice.exe	30
PID 2176 wrote to memory of 2628	2176	Draft Invoice.exe	32
PID 2176 wrote to memory of 2628	2176	Draft Invoice.exe	32
PID 2176 wrote to memory of 2628	2176	Draft Invoice.exe	32
PID 2176 wrote to memory of 2628	2176	Draft Invoice.exe	32
PID 2176 wrote to memory of 2468	2176	Draft Invoice.exe	34
PID 2176 wrote to memory of 2468	2176	Draft Invoice.exe	34
PID 2176 wrote to memory of 2468	2176	Draft Invoice.exe	34
PID 2176 wrote to memory of 2468	2176	Draft Invoice.exe	34
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35
PID 2176 wrote to memory of 2712	2176	Draft Invoice.exe	35

C:\Users\Admin\AppData\Local\Temp\Draft Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Draft Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Draft Invoice.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RHgYkIyZVdzw.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RHgYkIyZVdzw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8594.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\Draft Invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\Draft Invoice.exe"
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\Draft Invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\Draft Invoice.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp8594.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8594.tmp
Size 1KB
SHA256 9ca4a9eaf0c6fe646eb008c48ad296d44781f57bc7e6d4d5c601a6a2c2de4260
MD5 9ca23ba1293527aa4ae4723b690b01c0
SHA1 5a0b0e18c62c640c38f2e6a2f3b28e022f1262bd
SHA512 2490e181e35f5664cb13163ea70a7075fabbacf81bf094885d7c2702e8581a037e0fbeeca2bc75df8dc6f5d64c37688167c660a759d5e991b618dd791c3b3e91
MD5 SHA1 SHA512

Submit Download

SP1U3WAXYWB406W26J0Y.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SP1U3WAXYWB406W26J0Y.temp
Size 7KB
SHA256 6307d6bae1fc3204f1fdddba190121eaef6cda65718c9f122bf55521952db7f9
MD5 2a83eedc723b2fa16c4d37a58216b711
SHA1 ab4d4673bf5e95f786437587f64f7ed43a65fff3
SHA512 57cef615188c3d94c4237c43e54d4d4b1192aed02ae529e474663cd4e17e8cbe757e313cdebc8f46cdcb68b3007d94fc4e917ed9d0130be064cee7be76bec12f
SSDEEP 192:nAf5lUoQC3Af5lAHnoryCUSljq7SfluJJ:Af5lULCQf5lAHGyCUSlCSfluJJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1900-37-0x000000006EEF0000-0x000000006F49B000-memory.dmp

Download

memory/1900-42-0x000000006EEF0000-0x000000006F49B000-memory.dmp

Download

memory/1900-41-0x0000000002550000-0x0000000002590000-memory.dmp

Download

memory/1900-40-0x0000000002550000-0x0000000002590000-memory.dmp

Download

memory/1900-35-0x0000000002550000-0x0000000002590000-memory.dmp

Download

memory/1900-33-0x000000006EEF0000-0x000000006F49B000-memory.dmp

Download

memory/2176-0-0x0000000000CE0000-0x0000000000D84000-memory.dmp

Download

memory/2176-6-0x00000000050A0000-0x0000000005122000-memory.dmp

Download

memory/2176-4-0x0000000000470000-0x0000000000478000-memory.dmp

Download

memory/2176-5-0x0000000000480000-0x000000000048C000-memory.dmp

Download

memory/2176-2-0x0000000000750000-0x0000000000790000-memory.dmp

Download

memory/2176-32-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Download

memory/2176-3-0x00000000003C0000-0x00000000003D8000-memory.dmp

Download

memory/2176-1-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Download

memory/2564-36-0x000000006EEF0000-0x000000006F49B000-memory.dmp

Download

memory/2564-43-0x000000006EEF0000-0x000000006F49B000-memory.dmp

Download

memory/2564-34-0x000000006EEF0000-0x000000006F49B000-memory.dmp

Download

memory/2564-39-0x00000000026A0000-0x00000000026E0000-memory.dmp

Download

memory/2712-38-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Download

memory/2712-31-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2712-23-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2712-21-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2712-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2712-24-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2712-29-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2712-27-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2712-44-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Download