agenttesla | 43571627cd523d618bb987ce2f2c4cdaf3e51a0ff48e7a744d35d080cb36273e

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scan Copy 0092316282.exe
Size 704KB
Sample240422-pxcfgsbd63
SHA256 cd2240b914a8ca91dc4d31a19b30343b8a8c7d9deda5a65e6e8b696d0f07e677
MD5 065372dd1a1f4d0136a5ca6285e20a6d
SHA1 eddb2b7ba843c11ceb1b6c948081b7b5544ce095
SHA512 955fad682a5318b56fbc3b755e3ecc9f02e33c6e6f5d703a70e2e1bf41a2eab43ef177d7e798630f1c8c980cc2c2e73ffa2425b2e85fa0292a80c81da186949a
SSDEEP 12288:FgURX2c+5oibJgzIBPMLqQA8kkKtOqG8/jFQx+HNu1oJOcKgjW2jXU/rIHGWFC:Wr2QooEckfqe+Hg1ojDKg8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
shared48.accountservergroup.com
Port
587
Username
[email protected]
Password
stateng33r
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 3016	2736	Scan Copy 0092316282.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2736	Scan Copy 0092316282.exe
2628	powershell.exe
1508	powershell.exe
2736	Scan Copy 0092316282.exe
2736	Scan Copy 0092316282.exe
2736	Scan Copy 0092316282.exe
2736	Scan Copy 0092316282.exe
3016	RegSvcs.exe
3016	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	Scan Copy 0092316282.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	3016	RegSvcs.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1508	2736	Scan Copy 0092316282.exe	28
PID 2736 wrote to memory of 1508	2736	Scan Copy 0092316282.exe	28
PID 2736 wrote to memory of 1508	2736	Scan Copy 0092316282.exe	28
PID 2736 wrote to memory of 1508	2736	Scan Copy 0092316282.exe	28
PID 2736 wrote to memory of 2628	2736	Scan Copy 0092316282.exe	30
PID 2736 wrote to memory of 2628	2736	Scan Copy 0092316282.exe	30
PID 2736 wrote to memory of 2628	2736	Scan Copy 0092316282.exe	30
PID 2736 wrote to memory of 2628	2736	Scan Copy 0092316282.exe	30
PID 2736 wrote to memory of 2660	2736	Scan Copy 0092316282.exe	32
PID 2736 wrote to memory of 2660	2736	Scan Copy 0092316282.exe	32
PID 2736 wrote to memory of 2660	2736	Scan Copy 0092316282.exe	32
PID 2736 wrote to memory of 2660	2736	Scan Copy 0092316282.exe	32
PID 2736 wrote to memory of 2800	2736	Scan Copy 0092316282.exe	34
PID 2736 wrote to memory of 2800	2736	Scan Copy 0092316282.exe	34
PID 2736 wrote to memory of 2800	2736	Scan Copy 0092316282.exe	34
PID 2736 wrote to memory of 2800	2736	Scan Copy 0092316282.exe	34
PID 2736 wrote to memory of 2800	2736	Scan Copy 0092316282.exe	34
PID 2736 wrote to memory of 2800	2736	Scan Copy 0092316282.exe	34
PID 2736 wrote to memory of 2800	2736	Scan Copy 0092316282.exe	34
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35
PID 2736 wrote to memory of 3016	2736	Scan Copy 0092316282.exe	35

C:\Users\Admin\AppData\Local\Temp\Scan Copy 0092316282.exe
"C:\Users\Admin\AppData\Local\Temp\Scan Copy 0092316282.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Scan Copy 0092316282.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PmZmvSYsQGGHv.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PmZmvSYsQGGHv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4894.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4894.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4894.tmp
Size 1KB
SHA256 1284981b278a201d126d82b17bdf339818e76571a5c629cd746ede7f02bad0fc
MD5 581df9444c3a0a9349b3f63099ae4346
SHA1 09f00d8255e80129ea12202f1db3cd6eb5ca83fa
SHA512 1784c972e4a4b3cbf094dccd9a81c7cf3021e15c1fbaed13b867bcc6a80b8d25f037b8f073f699baf0fd02342ae739871221ee9f00abea6f7673a0a3fdd11cfa
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 572ebb99283b3ebbad1bbebc24aa573f7c46f25661aabd67ead4a1f8613dd3e1
MD5 ebb602c8db815fc7491f4151f585c927
SHA1 f157b222000cc5c03cee065ecf87287e5ef127d8
SHA512 5dd4ce9f4e83dd4f08b65fd83e50537a53937785196f90ece81cea3df5efcadac3949a74ed93454252098169e21473f12f98354cb50ac593e55cd1959ffef05e
SSDEEP 96:UnZmC9M8enqvsqvJCwoBs7nZmC9M8enqvsEHyqvJCworHsZ5BRXQHwE0E7Y5kXlU:ArqUoGrqAHnorq5z2P7Y5kC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1508-29-0x0000000002DF0000-0x0000000002E30000-memory.dmp

Download

memory/1508-20-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Download

memory/1508-45-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Download

memory/1508-31-0x0000000002DF0000-0x0000000002E30000-memory.dmp

Download

memory/1508-26-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Download

memory/1508-22-0x0000000002DF0000-0x0000000002E30000-memory.dmp

Download

memory/2628-33-0x0000000002E70000-0x0000000002EB0000-memory.dmp

Download

memory/2628-46-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Download

memory/2628-27-0x0000000002E70000-0x0000000002EB0000-memory.dmp

Download

memory/2628-21-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Download

memory/2628-24-0x000000006EBD0000-0x000000006F17B000-memory.dmp

Download

memory/2736-7-0x00000000001C0000-0x0000000000242000-memory.dmp

Download

memory/2736-5-0x00000000004A0000-0x00000000004AE000-memory.dmp

Download

memory/2736-0-0x0000000001120000-0x00000000011D6000-memory.dmp

Download

memory/2736-3-0x0000000000F10000-0x0000000000FAE000-memory.dmp

Download

memory/2736-1-0x0000000074B40000-0x000000007522E000-memory.dmp

Download

memory/2736-4-0x0000000000480000-0x0000000000498000-memory.dmp

Download

memory/2736-6-0x00000000004B0000-0x00000000004C4000-memory.dmp

Download

memory/2736-42-0x0000000074B40000-0x000000007522E000-memory.dmp

Download

memory/2736-2-0x0000000000FC0000-0x0000000001000000-memory.dmp

Download

memory/3016-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-37-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-25-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-41-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-39-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-43-0x0000000074B40000-0x000000007522E000-memory.dmp

Download

memory/3016-44-0x0000000004C20000-0x0000000004C60000-memory.dmp

Download

memory/3016-32-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/3016-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-47-0x0000000074B40000-0x000000007522E000-memory.dmp

Download