agenttesla | 1eedf5f70bcf194dfc8c5ae6caf0d272aa678d6631126f2e7d3f0681ada9efd9

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rSOAMAR-APR2024-7917089.exe
Size 743KB
Sample240515-nd9ffafa23
SHA256 1eedf5f70bcf194dfc8c5ae6caf0d272aa678d6631126f2e7d3f0681ada9efd9
MD5 7154bd52b1f1bca227835b96b42b0d73
SHA1 16b38b1ec14205708343659050bf225e76e0f7ae
SHA512 e0e82265a4cc126d71725c9f436f0632b18b056f659172f8940ab6354e4c329c2857508df773d8a2039257de0caa8ca25d36de638de895697844c9c3c99de1a4
SSDEEP 12288:bC21680skSKSIwX32SeLB+E4fcUhbxQEWqF9XjVI5KViVfiVOJKHLEAmDokR:bN1680JSNI/S0+r0UUJqF9QK4VqVJra
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.palumalimited.com
Port
587
Username
[email protected]
Password
85h!UAfvL2AE
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2108	powershell.exe
2348	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\yGbzOMp = "C:\\Users\\Admin\\AppData\\Roaming\\yGbzOMp\\yGbzOMp.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 2696	1960	rSOAMAR-APR2024-7917089.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1960	rSOAMAR-APR2024-7917089.exe
1960	rSOAMAR-APR2024-7917089.exe
1960	rSOAMAR-APR2024-7917089.exe
1960	rSOAMAR-APR2024-7917089.exe
2108	powershell.exe
2348	powershell.exe
2696	RegSvcs.exe
2696	RegSvcs.exe
2696	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	rSOAMAR-APR2024-7917089.exe
Token: SeDebugPrivilege	2696	RegSvcs.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2108	1960	rSOAMAR-APR2024-7917089.exe	28
PID 1960 wrote to memory of 2108	1960	rSOAMAR-APR2024-7917089.exe	28
PID 1960 wrote to memory of 2108	1960	rSOAMAR-APR2024-7917089.exe	28
PID 1960 wrote to memory of 2108	1960	rSOAMAR-APR2024-7917089.exe	28
PID 1960 wrote to memory of 2348	1960	rSOAMAR-APR2024-7917089.exe	30
PID 1960 wrote to memory of 2348	1960	rSOAMAR-APR2024-7917089.exe	30
PID 1960 wrote to memory of 2348	1960	rSOAMAR-APR2024-7917089.exe	30
PID 1960 wrote to memory of 2348	1960	rSOAMAR-APR2024-7917089.exe	30
PID 1960 wrote to memory of 3008	1960	rSOAMAR-APR2024-7917089.exe	31
PID 1960 wrote to memory of 3008	1960	rSOAMAR-APR2024-7917089.exe	31
PID 1960 wrote to memory of 3008	1960	rSOAMAR-APR2024-7917089.exe	31
PID 1960 wrote to memory of 3008	1960	rSOAMAR-APR2024-7917089.exe	31
PID 1960 wrote to memory of 3040	1960	rSOAMAR-APR2024-7917089.exe	34
PID 1960 wrote to memory of 3040	1960	rSOAMAR-APR2024-7917089.exe	34
PID 1960 wrote to memory of 3040	1960	rSOAMAR-APR2024-7917089.exe	34
PID 1960 wrote to memory of 3040	1960	rSOAMAR-APR2024-7917089.exe	34
PID 1960 wrote to memory of 3040	1960	rSOAMAR-APR2024-7917089.exe	34
PID 1960 wrote to memory of 3040	1960	rSOAMAR-APR2024-7917089.exe	34
PID 1960 wrote to memory of 3040	1960	rSOAMAR-APR2024-7917089.exe	34
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35
PID 1960 wrote to memory of 2696	1960	rSOAMAR-APR2024-7917089.exe	35

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\rSOAMAR-APR2024-7917089.exe
"C:\Users\Admin\AppData\Local\Temp\rSOAMAR-APR2024-7917089.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\rSOAMAR-APR2024-7917089.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hRPwVYSf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hRPwVYSf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5283.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5283.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5283.tmp
Size 1KB
SHA256 30abc1ca65d024ef0f30a65d189979b4f50eb8a4629e9ecdf452f54210e6d784
MD5 8e283232ec8df22645aa34bf2209f159
SHA1 30f2d9ec18c41af31ffcb1f8469f1a5dbd21baa5
SHA512 fbda5ac24747d424d87e34fef8cf64e70dbed9942b381b53cf8a7972cde219019a3237792346dd31c9e6341a909ad6ee62a9b7ae88ab2030a50a16fca9a9434d
MD5 SHA1 SHA512

Submit Download

WU3U3TVLVF0XGTWSUJUK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WU3U3TVLVF0XGTWSUJUK.temp
Size 7KB
SHA256 a4c0fbdbec2f82a43693600840b78a3e2bfc3c58360f976c6cd9bd60579618ff
MD5 bf6201fdbf24c5ae561a528192b276e4
SHA1 2c8024decedd461d3413bd65a577c7bda749e941
SHA512 905f50a12672e49667cd769ef40e3ed60d816ad6c0ccdc132f14c7d6df885297af05ff083a77a2827d1dc3e31011f5121b7fe956e080ccf9832a4268bc4cc6cd
SSDEEP 96:NK1GCCFOM8PnqvsqvJCwofK1GCCFOM8PnqvsEHyqvJCworVwPQQH6+7bIXlUVd:Y3bUoi3bAHnorVDf+7bIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1960-30-0x0000000074340000-0x0000000074A2E000-memory.dmp

Download

memory/1960-1-0x0000000000340000-0x00000000003FC000-memory.dmp

Download

memory/1960-2-0x0000000074340000-0x0000000074A2E000-memory.dmp

Download

memory/1960-3-0x00000000006D0000-0x00000000006EE000-memory.dmp

Download

memory/1960-4-0x00000000005A0000-0x00000000005B0000-memory.dmp

Download

memory/1960-5-0x00000000050B0000-0x000000000512E000-memory.dmp

Download

memory/1960-0-0x000000007434E000-0x000000007434F000-memory.dmp

Download

memory/2696-29-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2696-27-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2696-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2696-24-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2696-22-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2696-20-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2696-18-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2696-28-0x0000000000400000-0x000000000043C000-memory.dmp

Download