agenttesla | ca0bf7bb5880f8af7bfc35f0dba6fde5c68dd7212f02ed4f70260004e4effc98

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
noa.exe
Size 679KB
Sample240502-llgdhsgc39
SHA256 ca0bf7bb5880f8af7bfc35f0dba6fde5c68dd7212f02ed4f70260004e4effc98
MD5 ce55e5869c5b7274fdfee8145058a015
SHA1 e55050a6e94b96c4d9c74ec7b811b067a6dc93d3
SHA512 6c48dd5c4ab53acb790cbb2e4c74d80d9510393e80e3f3754f0541e878accd42af9518b123aaa978ac0e845d0bc70a35335af7d6645dae52b261ad0821470f54
SSDEEP 12288:nUu2iNdl2IUuHAf1SYn8//fzIpzEkcnW5k/5YH5rZn6VRIrUh3b7FfJP:x1Pl1HS1SSO3kAWDNZc3/P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.magna.com.pk
Port
587
Username
[email protected]
Password
Ahp6wqxfZb)D
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1516	powershell.exe
2716	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
2	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 2056	3000	noa.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3000	noa.exe
3000	noa.exe
2716	powershell.exe
1516	powershell.exe
2056	RegSvcs.exe
2056	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	noa.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	2056	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1516	3000	noa.exe	28
PID 3000 wrote to memory of 1516	3000	noa.exe	28
PID 3000 wrote to memory of 1516	3000	noa.exe	28
PID 3000 wrote to memory of 1516	3000	noa.exe	28
PID 3000 wrote to memory of 2716	3000	noa.exe	30
PID 3000 wrote to memory of 2716	3000	noa.exe	30
PID 3000 wrote to memory of 2716	3000	noa.exe	30
PID 3000 wrote to memory of 2716	3000	noa.exe	30
PID 3000 wrote to memory of 2736	3000	noa.exe	31
PID 3000 wrote to memory of 2736	3000	noa.exe	31
PID 3000 wrote to memory of 2736	3000	noa.exe	31
PID 3000 wrote to memory of 2736	3000	noa.exe	31
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34
PID 3000 wrote to memory of 2056	3000	noa.exe	34

C:\Users\Admin\AppData\Local\Temp\noa.exe
"C:\Users\Admin\AppData\Local\Temp\noa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\noa.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BPRNYujHfkzq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BPRNYujHfkzq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp32B4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp32B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp32B4.tmp
Size 1KB
SHA256 78e7fca513dbc5f5f06ec849031293d03a73e01b39646e707a47f3ee1219cace
MD5 33fa620139e37eb16348e9b2853e574f
SHA1 5844fca2b70868608ce3645cefeb620a29ea3bbe
SHA512 9c073cc6e3e95bbeb2cdf9390c8e373a86e72b99a8c2cedaf09016024954abb5d00f437ea628de6c54b91a897ba17758bbf1da63947daa13923704a7a4605557
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 841a4c565dabd4454703ebd6de69a40707d4e64e292747ffefdbe8be37ac52a8
MD5 1d60b420ced25be6111ba4180e1897a7
SHA1 47b0d544f33e6383a48b63815940d250526e117f
SHA512 bc38aaac9e893d1082f63332bf1ba15e08ad3ba7ace50d1f4a35c8828a580db67d484264c9704da7648361e0b3602c81f22164d053433fc2454e142829b21cc5
SSDEEP 96:QFKCBM8NnqvsqvJCwo2FKCBM8NnqvsEHyqvJCworMdGzQHDr7W7XlUVV:UDZUoWDZAHnorM0Kr7W7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2056-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2056-29-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2056-20-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2056-27-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2056-22-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2056-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2056-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2056-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/3000-2-0x0000000074050000-0x000000007473E000-memory.dmp

Download

memory/3000-1-0x00000000009D0000-0x0000000000A80000-memory.dmp

Download

memory/3000-0-0x000000007405E000-0x000000007405F000-memory.dmp

Download

memory/3000-3-0x00000000004E0000-0x00000000004F6000-memory.dmp

Download

memory/3000-5-0x0000000005250000-0x00000000052D2000-memory.dmp

Download

memory/3000-4-0x0000000000520000-0x0000000000536000-memory.dmp

Download

memory/3000-30-0x0000000074050000-0x000000007473E000-memory.dmp

Download