agenttesla | 2916aaeb7d7e58aa792eed52d800227a159ac94d5dbbd95cfa5ec133d3dc90f0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe
Size

558KB
MD5

eef80ad0744688be6c6029e7793dcf91
SHA1

35c0251531d08a060807c429e0833b5d48099a9d
SHA256

8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b
SHA512

ed28dbb5861aa55f64a0ff08851df3419275c780bc215a5821d08a49c5f1ccc16b0d7ba635f9394b467a48caef841101254dc8982bd0b28b0a3bdcc661bc870c
SSDEEP

12288:EMwrhdMp7SyAHZ5lEhugESlldjfmj/IiZY4CqXr6pSD8gZLI:EMwr0p7STUE6+jdm9qb/8gZI

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.myhydropowered.com
Port:
587
Username:
[email protected]
Password:
yV0cOwpBjCCXLvN
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Loads dropped DLL 1 IoCs

pid	Process
4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder1\\Pseudodiphtheric.exe"	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FTSKIaM = "C:\\Users\\Admin\\AppData\\Roaming\\FTSKIaM\\FTSKIaM.exe"	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	drive.google.com
28	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	api.ipify.org
44	api.ipify.org
49	ip-api.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
668	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe
668	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4452 set thread context of 668	4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
668	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe
668	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 668	4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe	89
PID 4452 wrote to memory of 668	4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe	89
PID 4452 wrote to memory of 668	4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe	89
PID 4452 wrote to memory of 668	4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe	89
PID 4452 wrote to memory of 668	4452	8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe	89

C:\Users\Admin\AppData\Local\Temp\8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe
"C:\Users\Admin\AppData\Local\Temp\8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe
  "C:\Users\Admin\AppData\Local\Temp\8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Setup.ini

Filesize
87B

MD5
85e2e4621b02840d074412427cd1f8a5

SHA1
1c54ee06a603cbd345dc37a17072d72886f71f08

SHA256
26c8d3247b977b06a3106999a4c3bcc18a0004e5cf506b42dc54631ca1d0de0d

SHA512
7b4ebf73e648b3fc062dd59e48ecbec2bf7cafd964c7d7daf507eb04d9782d29668cbcda9f47b167383bb9b6a1a0f07ec6752baf4351f8e80f92bfed8abd1f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.ini

Filesize
126B

MD5
7f000c5d46d8d55b51dab133157cf3db

SHA1
59d5389a1b5b53641ed2f5d9256738b5ac4091e4

SHA256
f309553da24996f82ad83e653644eedf3e474d847fdf400f7f7a57e8d945b7d0

SHA512
72332e482ec7f542e25b59a635a7548fee964d03f9387e37342738a605eae8922f954208a71fd8b063242fceb4e93f67729b1af29c2d4f2b14269af4fef87df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.ini

Filesize
102B

MD5
87b7b5a5fa6b1059d77d7982bd01e988

SHA1
10d4ea569e287b1ff20e8bf90c8f126684858a39

SHA256
1ea49332af8831ec45b054c136b810caad752c41f3547d15fbb388c48ac2b7df

SHA512
73d115be3501c4c03f6c0d8c0e0c93693562e770d9c22b84b8bdf429c5444d127f0b0bbc81b3949a0c70d3497d546365a2d5ff840ff8b4bd5c3f5225dd3c02d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.ini

Filesize
109B

MD5
a70ed0b8655a9a6a9096c9aaaeb5cd07

SHA1
5e66de4ad79ada2ce40d41d7fb4463ec51b98fde

SHA256
9fe9cb54b8623e3035bb4cd7b472fabaed913e7960e0f65731ee5be12166022c

SHA512
21248c55922cf476490aa394fb1703c6de927fbd578a93d341a1eda474519fecdd6f5bb5211673cc3c0eaf228c468a78e40fd7c125a899765830450c218f9029

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.ini

Filesize
104B

MD5
451db23a37ed16feef78f3d3605d751d

SHA1
f501346fd7d71d9d78aa2229a022e4ffffaa2216

SHA256
25671712102cc6fe452500449af769e0a26bd436f87a55c118eb2d68648b5f3c

SHA512
95b0363940e77dac2eadce7d46c3998c01bd6ccb0c97602da4382b9bb036384b4bca62c69d84ab651426f5818551933785a1ed1b58f8fd6bba7fdea6e4b8034e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2ACA.tmp\System.dll

Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
memory/668-685-0x00000000776D1000-0x00000000777F1000-memory.dmp

Filesize
1.1MB

Download
memory/668-694-0x000000003A670000-0x000000003A702000-memory.dmp

Filesize
584KB

Download
memory/668-668-0x0000000077758000-0x0000000077759000-memory.dmp

Filesize
4KB

Download
memory/668-670-0x00000000776D1000-0x00000000777F1000-memory.dmp

Filesize
1.1MB

Download
memory/668-671-0x0000000000490000-0x00000000016E4000-memory.dmp

Filesize
18.3MB

Download
memory/668-699-0x0000000039C50000-0x0000000039C60000-memory.dmp

Filesize
64KB

Download
memory/668-684-0x0000000000490000-0x00000000016E4000-memory.dmp

Filesize
18.3MB

Download
memory/668-686-0x0000000000490000-0x00000000004D2000-memory.dmp

Filesize
264KB

Download
memory/668-687-0x0000000071D10000-0x00000000724C0000-memory.dmp

Filesize
7.7MB

Download
memory/668-688-0x00000000395E0000-0x0000000039B84000-memory.dmp

Filesize
5.6MB

Download
memory/668-689-0x0000000039C50000-0x0000000039C60000-memory.dmp

Filesize
64KB

Download
memory/668-690-0x0000000039D60000-0x0000000039DC6000-memory.dmp

Filesize
408KB

Download
memory/668-693-0x000000003A620000-0x000000003A670000-memory.dmp

Filesize
320KB

Download
memory/668-698-0x0000000071D10000-0x00000000724C0000-memory.dmp

Filesize
7.7MB

Download
memory/668-695-0x000000003A740000-0x000000003A74A000-memory.dmp

Filesize
40KB

Download
memory/4452-667-0x0000000074530000-0x0000000074537000-memory.dmp

Filesize
28KB

Download
memory/4452-666-0x00000000776D1000-0x00000000777F1000-memory.dmp

Filesize
1.1MB

Download