agenttesla | 0cfbe133465059e9d21adb0ee0bcf53ecb2f3459bc258b9a78c6a56cfbf15f27

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paid Invoice #907238.exe
Size 688KB
Sample240508-jfx3zacb67
SHA256 0cfbe133465059e9d21adb0ee0bcf53ecb2f3459bc258b9a78c6a56cfbf15f27
MD5 d20d8dd04625910814086b4f98fc55a6
SHA1 01dfe8a799f4ea1397cb1aaaa8e14aca218dd3a3
SHA512 42ee37ddf6571f68a60e851285a88ce341fe26748774dc6c0d403b53d7b519860d6043a2023a620a7076738f17b0b184a988629d6ded337ad8a951a3a9330513
SSDEEP 12288:jr3/T3/fVrTtK3/d8ynfW57rNtlNJsEIPiddmbU4wbbMl13bwgu8Nnbh3/43/:/rXVrTtKLns/ltI6abU4wkZwgDnbhA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
PMOYQrU0
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2028	powershell.exe
2060	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2464 set thread context of 2892	2464	Paid Invoice #907238.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2464	Paid Invoice #907238.exe
2464	Paid Invoice #907238.exe
2892	Paid Invoice #907238.exe
2892	Paid Invoice #907238.exe
2028	powershell.exe
2060	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	Paid Invoice #907238.exe
Token: SeDebugPrivilege	2892	Paid Invoice #907238.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2028	2464	Paid Invoice #907238.exe	28
PID 2464 wrote to memory of 2028	2464	Paid Invoice #907238.exe	28
PID 2464 wrote to memory of 2028	2464	Paid Invoice #907238.exe	28
PID 2464 wrote to memory of 2028	2464	Paid Invoice #907238.exe	28
PID 2464 wrote to memory of 2060	2464	Paid Invoice #907238.exe	30
PID 2464 wrote to memory of 2060	2464	Paid Invoice #907238.exe	30
PID 2464 wrote to memory of 2060	2464	Paid Invoice #907238.exe	30
PID 2464 wrote to memory of 2060	2464	Paid Invoice #907238.exe	30
PID 2464 wrote to memory of 2600	2464	Paid Invoice #907238.exe	32
PID 2464 wrote to memory of 2600	2464	Paid Invoice #907238.exe	32
PID 2464 wrote to memory of 2600	2464	Paid Invoice #907238.exe	32
PID 2464 wrote to memory of 2600	2464	Paid Invoice #907238.exe	32
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34
PID 2464 wrote to memory of 2892	2464	Paid Invoice #907238.exe	34

C:\Users\Admin\AppData\Local\Temp\Paid Invoice #907238.exe
"C:\Users\Admin\AppData\Local\Temp\Paid Invoice #907238.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Paid Invoice #907238.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CsrqNkKedp.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CsrqNkKedp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4106.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\Paid Invoice #907238.exe
  "C:\Users\Admin\AppData\Local\Temp\Paid Invoice #907238.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4106.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4106.tmp
Size 1KB
SHA256 943a8812e1d3cf2612a8448e0a034952991b19768523999706e7584a6ff02ef0
MD5 dd9955f644618f1dd3a02d27bea65bc8
SHA1 1b08489dec82c228dbdc88e2325ce38b3ad73125
SHA512 3c9db94ec606654257726f0699d854092c5a126b05a9c175d8c1d0b063141f72caefa566e8ff214ca2f1326736238aafdebd8909efce894daed0b114ea5f4702
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 93b6c3a8d56358363ea7638f75b6fdd29077d7c386ce63aba2ca4692bba01677
MD5 d92d2b65660f60b083c18a17ede4a4d3
SHA1 4d2e9d0a2232c8915c3d601fe536a018ec92a554
SHA512 9912ca9d1e2275256ef97ef0f8b73f4efcbb8b70883b0ff02cc349bc2bc88370c112dc81c33c86f93ebef0c533023194cc7a9e8cd86ae154bf0eaa35faebd95a
SSDEEP 96:led0PCBM8pnqvsqvJCwoied0PCBM8pnqvsEHyqvJCworqPKwNQHlzHEz7RPwXlUk:8009Uol009AHnorqPvYzkz7RPwx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2464-30-0x0000000074680000-0x0000000074D6E000-memory.dmp

Download

memory/2464-1-0x0000000001010000-0x00000000010C0000-memory.dmp

Download

memory/2464-2-0x0000000000320000-0x0000000000336000-memory.dmp

Download

memory/2464-3-0x0000000074680000-0x0000000074D6E000-memory.dmp

Download

memory/2464-4-0x00000000003E0000-0x00000000003F6000-memory.dmp

Download

memory/2464-5-0x0000000005150000-0x00000000051D4000-memory.dmp

Download

memory/2464-0-0x000000007468E000-0x000000007468F000-memory.dmp

Download

memory/2892-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2892-27-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2892-29-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2892-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2892-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2892-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2892-20-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2892-22-0x0000000000400000-0x0000000000442000-memory.dmp

Download