agenttesla | c1f17712810a4cf0a12284d47e17b97f53edcf818993c50edc076ba3e7d9135d

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tempe.exe
Size

1.0MB
MD5

bebe5907e39cdbd2a097c0325f6b12ed
SHA1

8ebfa77700a40d7935e41c376c0f0962c62e1c5a
SHA256

c1f17712810a4cf0a12284d47e17b97f53edcf818993c50edc076ba3e7d9135d
SHA512

d107f99e99966d4f21e0ca363e80fe825cf3edc067eacf3eda68e1d8df846168809497d57336210070ddc68d9e4eb375f0d0f03bf7670e5cdf35817afd2d701c
SSDEEP

24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaNdYpcqO6p5:ph+ZkldoPK8YaNCOo

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.cash4cars.nz
Port:
587
Username:
[email protected]
Password:
logs2024!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\newfile = "C:\\Users\\Admin\\AppData\\Roaming\\newfile\\newfile.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

tempe.exe

description pid process target process

PID 2188 set thread context of 2508 2188 tempe.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2572 2188 WerFault.exe tempe.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2508 RegSvcs.exe
2508 RegSvcs.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

tempe.exe

pid process

2188 tempe.exe
2188 tempe.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2508 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

tempe.exe

pid process

2188 tempe.exe
2188 tempe.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

tempe.exe

pid process

2188 tempe.exe
2188 tempe.exe

flow	ioc
4	ip-api.com

description	pid	process	target process
PID 2188 set thread context of 2508	2188	tempe.exe	RegSvcs.exe

pid	pid_target	process	target process
2572	2188	WerFault.exe	tempe.exe

pid	process
2508	RegSvcs.exe
2508	RegSvcs.exe

pid	process
2188	tempe.exe
2188	tempe.exe

description	pid	process
Token: SeDebugPrivilege	2508	RegSvcs.exe

pid	process
2188	tempe.exe
2188	tempe.exe

pid	process
2188	tempe.exe
2188	tempe.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

tempe.exe

description	pid	process	target process
PID 2188 wrote to memory of 2508	2188	tempe.exe	RegSvcs.exe
PID 2188 wrote to memory of 2508	2188	tempe.exe	RegSvcs.exe
PID 2188 wrote to memory of 2508	2188	tempe.exe	RegSvcs.exe
PID 2188 wrote to memory of 2508	2188	tempe.exe	RegSvcs.exe
PID 2188 wrote to memory of 2508	2188	tempe.exe	RegSvcs.exe
PID 2188 wrote to memory of 2508	2188	tempe.exe	RegSvcs.exe
PID 2188 wrote to memory of 2508	2188	tempe.exe	RegSvcs.exe
PID 2188 wrote to memory of 2508	2188	tempe.exe	RegSvcs.exe
PID 2188 wrote to memory of 2572	2188	tempe.exe	WerFault.exe
PID 2188 wrote to memory of 2572	2188	tempe.exe	WerFault.exe
PID 2188 wrote to memory of 2572	2188	tempe.exe	WerFault.exe
PID 2188 wrote to memory of 2572	2188	tempe.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tempe.exe
"C:\Users\Admin\AppData\Local\Temp\tempe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\tempe.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 316
2⤵
- Program crash
PID:2572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-10-0x0000000000270000-0x0000000000274000-memory.dmp

Filesize
16KB

Download
memory/2508-11-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download
memory/2508-13-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download
memory/2508-17-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download
memory/2508-20-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download
memory/2508-21-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/2508-22-0x00000000010B0000-0x00000000010F0000-memory.dmp

Filesize
256KB

Download
memory/2508-24-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/2508-25-0x00000000010B0000-0x00000000010F0000-memory.dmp

Filesize
256KB

Download