agenttesla | c1f17712810a4cf0a12284d47e17b97f53edcf818993c50edc076ba3e7d9135d

Analysis

max time kernel
136s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tempe.exe
Size

1.0MB
MD5

bebe5907e39cdbd2a097c0325f6b12ed
SHA1

8ebfa77700a40d7935e41c376c0f0962c62e1c5a
SHA256

c1f17712810a4cf0a12284d47e17b97f53edcf818993c50edc076ba3e7d9135d
SHA512

d107f99e99966d4f21e0ca363e80fe825cf3edc067eacf3eda68e1d8df846168809497d57336210070ddc68d9e4eb375f0d0f03bf7670e5cdf35817afd2d701c
SSDEEP

24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaNdYpcqO6p5:ph+ZkldoPK8YaNCOo

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.cash4cars.nz
Port:
587
Username:
[email protected]
Password:
logs2024!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newfile = "C:\\Users\\Admin\\AppData\\Roaming\\newfile\\newfile.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

tempe.exe

description pid process target process

PID 3152 set thread context of 636 3152 tempe.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

636 RegSvcs.exe
636 RegSvcs.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

tempe.exe

pid process

3152 tempe.exe
3152 tempe.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 636 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

tempe.exe

pid process

3152 tempe.exe
3152 tempe.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

tempe.exe

pid process

3152 tempe.exe
3152 tempe.exe

flow	ioc
15	ip-api.com

description	pid	process	target process
PID 3152 set thread context of 636	3152	tempe.exe	RegSvcs.exe

pid	process
636	RegSvcs.exe
636	RegSvcs.exe

pid	process
3152	tempe.exe
3152	tempe.exe

description	pid	process
Token: SeDebugPrivilege	636	RegSvcs.exe

pid	process
3152	tempe.exe
3152	tempe.exe

pid	process
3152	tempe.exe
3152	tempe.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

tempe.exe

description	pid	process	target process
PID 3152 wrote to memory of 636	3152	tempe.exe	RegSvcs.exe
PID 3152 wrote to memory of 636	3152	tempe.exe	RegSvcs.exe
PID 3152 wrote to memory of 636	3152	tempe.exe	RegSvcs.exe
PID 3152 wrote to memory of 636	3152	tempe.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\tempe.exe
"C:\Users\Admin\AppData\Local\Temp\tempe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\tempe.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:1564

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-11-0x0000000000730000-0x0000000000772000-memory.dmp

Filesize
264KB

Download
memory/636-12-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/636-13-0x0000000005390000-0x0000000005934000-memory.dmp

Filesize
5.6MB

Download
memory/636-14-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/636-15-0x0000000004EE0000-0x0000000004F46000-memory.dmp

Filesize
408KB

Download
memory/636-17-0x0000000006070000-0x00000000060C0000-memory.dmp

Filesize
320KB

Download
memory/636-18-0x0000000006160000-0x00000000061F2000-memory.dmp

Filesize
584KB

Download
memory/636-19-0x00000000060F0000-0x00000000060FA000-memory.dmp

Filesize
40KB

Download
memory/636-20-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/636-21-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/3152-10-0x0000000001280000-0x0000000001284000-memory.dmp

Filesize
16KB

Download