agenttesla | 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2784277bd68152abf75c6c6d59fab7af.exe
Size

2.3MB
MD5

2784277bd68152abf75c6c6d59fab7af
SHA1

e1d047c97e3bdfe273b215b42eccde32ca2ca63f
SHA256

737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc
SHA512

e05b8251c9f6c59c7901d72c58f5b8c35dc376068368e67f81ee79da4287ddfc25c6ca5893d87944ed21c592bdd62f57d40a9f78c9af56762f33b010dd10b62c
SSDEEP

49152:T2Q8G4mSmM8sik/AJ+/GRfzlW+oCZBNKoiYNsVjGMFWm02qG6zSo2:T2VmT8B4JAGllW+DBNdtN811

Score

10^/10

agenttesla umbral evasion keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023252-7.dat	family_umbral
behavioral2/memory/4748-17-0x000001354A1D0000-0x000001354A210000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/3892-42-0x000002A261060000-0x000002A261274000-memory.dmp	family_agenttesla

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1552	netsh.exe
1972	netsh.exe
2404	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2784277bd68152abf75c6c6d59fab7af.exe

Executes dropped EXE 3 IoCs

pid	Process
4748	Umbral.exe
3092	svchost.exe
3892	ANDYzz-protected.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	0.tcp.eu.ngrok.io
62	0.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	ANDYzz-protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ANDYzz-protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ANDYzz-protected.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	Umbral.exe
Token: SeIncreaseQuotaPrivilege	1904	wmic.exe
Token: SeSecurityPrivilege	1904	wmic.exe
Token: SeTakeOwnershipPrivilege	1904	wmic.exe
Token: SeLoadDriverPrivilege	1904	wmic.exe
Token: SeSystemProfilePrivilege	1904	wmic.exe
Token: SeSystemtimePrivilege	1904	wmic.exe
Token: SeProfSingleProcessPrivilege	1904	wmic.exe
Token: SeIncBasePriorityPrivilege	1904	wmic.exe
Token: SeCreatePagefilePrivilege	1904	wmic.exe
Token: SeBackupPrivilege	1904	wmic.exe
Token: SeRestorePrivilege	1904	wmic.exe
Token: SeShutdownPrivilege	1904	wmic.exe
Token: SeDebugPrivilege	1904	wmic.exe
Token: SeSystemEnvironmentPrivilege	1904	wmic.exe
Token: SeRemoteShutdownPrivilege	1904	wmic.exe
Token: SeUndockPrivilege	1904	wmic.exe
Token: SeManageVolumePrivilege	1904	wmic.exe
Token: 33	1904	wmic.exe
Token: 34	1904	wmic.exe
Token: 35	1904	wmic.exe
Token: 36	1904	wmic.exe
Token: SeIncreaseQuotaPrivilege	1904	wmic.exe
Token: SeSecurityPrivilege	1904	wmic.exe
Token: SeTakeOwnershipPrivilege	1904	wmic.exe
Token: SeLoadDriverPrivilege	1904	wmic.exe
Token: SeSystemProfilePrivilege	1904	wmic.exe
Token: SeSystemtimePrivilege	1904	wmic.exe
Token: SeProfSingleProcessPrivilege	1904	wmic.exe
Token: SeIncBasePriorityPrivilege	1904	wmic.exe
Token: SeCreatePagefilePrivilege	1904	wmic.exe
Token: SeBackupPrivilege	1904	wmic.exe
Token: SeRestorePrivilege	1904	wmic.exe
Token: SeShutdownPrivilege	1904	wmic.exe
Token: SeDebugPrivilege	1904	wmic.exe
Token: SeSystemEnvironmentPrivilege	1904	wmic.exe
Token: SeRemoteShutdownPrivilege	1904	wmic.exe
Token: SeUndockPrivilege	1904	wmic.exe
Token: SeManageVolumePrivilege	1904	wmic.exe
Token: 33	1904	wmic.exe
Token: 34	1904	wmic.exe
Token: 35	1904	wmic.exe
Token: 36	1904	wmic.exe
Token: SeDebugPrivilege	3892	ANDYzz-protected.exe
Token: SeDebugPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe
Token: SeIncBasePriorityPrivilege	3092	svchost.exe
Token: 33	3092	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4748	1380	2784277bd68152abf75c6c6d59fab7af.exe	91
PID 1380 wrote to memory of 4748	1380	2784277bd68152abf75c6c6d59fab7af.exe	91
PID 1380 wrote to memory of 3092	1380	2784277bd68152abf75c6c6d59fab7af.exe	92
PID 1380 wrote to memory of 3092	1380	2784277bd68152abf75c6c6d59fab7af.exe	92
PID 1380 wrote to memory of 3092	1380	2784277bd68152abf75c6c6d59fab7af.exe	92
PID 1380 wrote to memory of 3892	1380	2784277bd68152abf75c6c6d59fab7af.exe	93
PID 1380 wrote to memory of 3892	1380	2784277bd68152abf75c6c6d59fab7af.exe	93
PID 4748 wrote to memory of 1904	4748	Umbral.exe	94
PID 4748 wrote to memory of 1904	4748	Umbral.exe	94
PID 3092 wrote to memory of 1552	3092	svchost.exe	97
PID 3092 wrote to memory of 1552	3092	svchost.exe	97
PID 3092 wrote to memory of 1552	3092	svchost.exe	97
PID 3092 wrote to memory of 1972	3092	svchost.exe	100
PID 3092 wrote to memory of 1972	3092	svchost.exe	100
PID 3092 wrote to memory of 1972	3092	svchost.exe	100
PID 3092 wrote to memory of 2404	3092	svchost.exe	101
PID 3092 wrote to memory of 2404	3092	svchost.exe	101
PID 3092 wrote to memory of 2404	3092	svchost.exe	101

C:\Users\Admin\AppData\Local\Temp\2784277bd68152abf75c6c6d59fab7af.exe
"C:\Users\Admin\AppData\Local\Temp\2784277bd68152abf75c6c6d59fab7af.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1552
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Modifies Windows Firewall
    PID:1972
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2404
- C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe
  "C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3648 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe

Filesize
2.5MB

MD5
33eb68c8c4fc521d64ed82219cdb19f2

SHA1
2d114152924ea141df11082d6f337bf7e9a81035

SHA256
24251c6105a1f345dbb16860c2405647127b8b03e03b0d0c1c61f896a6c7b7b0

SHA512
0b5090dbb977ac8b79b01a3d33c26592a7b98bd9461212f70fa3c092b359c93ad22c1c4bace3aacc22c74884b154989be2a724edf74efd20ef80dee78ac75f8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
231KB

MD5
774fa31e76af56bbad395e1e3ac68721

SHA1
fe65c14179b2cf0cbd44758578cf878d7dcef879

SHA256
944c19f992f5301ac8936dcdbd4efb59fbc4f47dcdcc39a77b5e87b4effd27f4

SHA512
529ba2a356bf4fb3d4820c0da1dca58d1583ae37188e61300190d543144140f0f73072a9faf195dc214a13ac8c365354e2ab212a24646a332085481f47de8c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
93KB

MD5
3071f4f7b11a6bf6c623e83eed6d2418

SHA1
37fd78d1296659109f2c94c9c750b5a98d158f11

SHA256
508bcd1a6b7ed82e60873eb1b035647ec9f8f9facdf65d6d6a73b8ef37d5bb9e

SHA512
e6bc32a3c955f80a9a54c261722f49032c1f32c50f98f0792af85769b87b4e9ef16ee4fd4f1e9e0a991e6f9311d54db99737401e6b5f32b503531e6859ad45b8

Download Submit
memory/1380-1-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

Filesize
10.8MB

Download
memory/1380-2-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Filesize
64KB

Download
memory/1380-0-0x0000000000030000-0x000000000028A000-memory.dmp

Filesize
2.4MB

Download
memory/1380-36-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

Filesize
10.8MB

Download
memory/3092-45-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/3092-53-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/3092-52-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/3092-46-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/3892-47-0x000002A261050000-0x000002A261060000-memory.dmp

Filesize
64KB

Download
memory/3892-40-0x000002A260D90000-0x000002A260DA2000-memory.dmp

Filesize
72KB

Download
memory/3892-41-0x000002A261050000-0x000002A261060000-memory.dmp

Filesize
64KB

Download
memory/3892-42-0x000002A261060000-0x000002A261274000-memory.dmp

Filesize
2.1MB

Download
memory/3892-37-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

Filesize
10.8MB

Download
memory/3892-35-0x000002A246780000-0x000002A2469FE000-memory.dmp

Filesize
2.5MB

Download
memory/3892-48-0x000002A264030000-0x000002A26406C000-memory.dmp

Filesize
240KB

Download
memory/3892-50-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

Filesize
10.8MB

Download
memory/3892-51-0x000002A261050000-0x000002A261060000-memory.dmp

Filesize
64KB

Download
memory/4748-44-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

Filesize
10.8MB

Download
memory/4748-38-0x000001354BEC0000-0x000001354BED0000-memory.dmp

Filesize
64KB

Download
memory/4748-20-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

Filesize
10.8MB

Download
memory/4748-17-0x000001354A1D0000-0x000001354A210000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads