agenttesla | d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
Size

723KB
MD5

88be5523b8927cec8ed429249f77a2ec
SHA1

bab24a7676c2a150b9fb2d3200a2ba6b3106cf69
SHA256

d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97
SHA512

e0a04e1d2fdbdd5d4cf154572b2de33568009eadcfe8655d6b434b62fc57a199df018aa63c89efdc149bcf22c70eb81a9a9b462eec3595224c79f4aa3c3ff1f9
SSDEEP

12288:fReLAfP7wDdK4o/yMknMQWrC2PYwvDpftEQKeUtAUWU62TkR:J537wDdz7MrW2PhVftyHl8Z

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.shaktiinstrumentations.in
Port:
587
Username:
[email protected]
Password:
Shakti54231!@#$%#@!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

resource	yara_rule
behavioral1/memory/2552-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2552-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2552-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2552-23-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2552-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

resource	yara_rule
behavioral1/memory/2552-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2552-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2552-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2552-23-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2552-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/memory/1948-3-0x0000000000970000-0x000000000098E000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

resource	yara_rule
behavioral1/memory/2552-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2552-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2552-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2552-23-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2552-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2552-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2552-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2552-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2552-23-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2552-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2552-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2552-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2552-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2552-23-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2552-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2552-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2552-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2552-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2552-23-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2552-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2612	powershell.exe
2508	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
2508	powershell.exe
2612	powershell.exe
2552	RegSvcs.exe
2552	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2552	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2612	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	28
PID 1948 wrote to memory of 2612	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	28
PID 1948 wrote to memory of 2612	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	28
PID 1948 wrote to memory of 2612	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	28
PID 1948 wrote to memory of 2508	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	30
PID 1948 wrote to memory of 2508	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	30
PID 1948 wrote to memory of 2508	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	30
PID 1948 wrote to memory of 2508	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	30
PID 1948 wrote to memory of 2656	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	31
PID 1948 wrote to memory of 2656	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	31
PID 1948 wrote to memory of 2656	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	31
PID 1948 wrote to memory of 2656	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	31
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34
PID 1948 wrote to memory of 2552	1948	d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe	34

C:\Users\Admin\AppData\Local\Temp\d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe
"C:\Users\Admin\AppData\Local\Temp\d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d3ee113c39ec074e30b6248bc6362ee4c742214e075538b708384e01bf1e2d97.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TSFolXtUuNQqQ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TSFolXtUuNQqQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6393.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6393.tmp

Filesize
1KB

MD5
5b2f09b9f6a03985add5edbb13ee4323

SHA1
88f5741da176e6430ed8bd8679fdb0a79928332f

SHA256
44f1cfea1c3ea21a9205cc2a5dcbaaf896455ef20574538241765e61f6eff678

SHA512
96797c7a6baef639de61893517e13923632a7455ec27253719dd5963dfc3d2966f34e1215d6eee6975659934676d53a243fc6177868ab5aa5895020b15113dd9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CT4GGSG9TGTX2G5FZSYH.temp

Filesize
7KB

MD5
72ebef0501a184aa3bb56f8ada140bdc

SHA1
0e0a2a8418d26b189547f486a1f9eca76105654d

SHA256
956c699b0067b38ce458c2094e504d7e30e0a2a7ddd9f707e81f56a345421789

SHA512
26e3b0114ec50b1df3894e84370c2eba2e3aca0ba7d0e1889bb65a0862857c611560f8042672d1f93f56ceb21338dc712fb132ddaa19b11815d23c1428948786

Download Submit
memory/1948-4-0x0000000000A10000-0x0000000000A20000-memory.dmp

Filesize
64KB

Download
memory/1948-31-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1948-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

Filesize
4KB

Download
memory/1948-5-0x0000000000A60000-0x0000000000A76000-memory.dmp

Filesize
88KB

Download
memory/1948-6-0x0000000005410000-0x0000000005494000-memory.dmp

Filesize
528KB

Download
memory/1948-2-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1948-1-0x0000000000FA0000-0x0000000001056000-memory.dmp

Filesize
728KB

Download
memory/1948-3-0x0000000000970000-0x000000000098E000-memory.dmp

Filesize
120KB

Download
memory/2552-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2552-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2552-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2552-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2552-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2552-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2552-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download