agenttesla | 5e921611411a1f372b02c4655a25f021c666b897e6e4f0ff59ef8a8877792c1f

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSK203.exe
Size

495KB
MD5

672127d627b0d1ffdc8f4f6a7f6a4697
SHA1

965c08f135e270201ca61122955104c0de39ad9f
SHA256

c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42
SHA512

f3e6c7837c767944d7e14cac75e5844fa217cfdc3d6dcae575a7d0ad2740617cce9e53e6b28f947114708361570972150737c9c1e3663b5b3ee9fd55a2d6a746
SSDEEP

12288:Pbm37Owct5ERd1ZRad1I5eA2bZxeyCNNrmj:Pbms5EP1CAsZxse

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot6859247669:AAER1Rty_3TqZr1VmGGzXWMbtAZFtnPCWCU/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Loads dropped DLL 2 IoCs

Processes:

MSK203.exe

pid process

2800 MSK203.exe
2800 MSK203.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 api.ipify.org
24 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

MSK203.exe

pid process

2612 MSK203.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

MSK203.exeMSK203.exe

pid process

2800 MSK203.exe
2612 MSK203.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

MSK203.exe

description pid process target process

PID 2800 set thread context of 2612 2800 MSK203.exe MSK203.exe
Drops file in Windows directory 1 IoCs

Processes:

MSK203.exe

description ioc process

File opened for modification C:\Windows\Fonts\Apoplektikerens\Chateaubriand.Exi MSK203.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSK203.exe

pid process

2612 MSK203.exe
2612 MSK203.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

MSK203.exe

pid process

2800 MSK203.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSK203.exe

description pid process

Token: SeDebugPrivilege 2612 MSK203.exe

pid	process
2800	MSK203.exe
2800	MSK203.exe

flow	ioc
23	api.ipify.org
24	api.ipify.org

pid	process
2612	MSK203.exe

pid	process
2800	MSK203.exe
2612	MSK203.exe

description	pid	process	target process
PID 2800 set thread context of 2612	2800	MSK203.exe	MSK203.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\Apoplektikerens\Chateaubriand.Exi	MSK203.exe

pid	process
2612	MSK203.exe
2612	MSK203.exe

pid	process
2800	MSK203.exe

description	pid	process
Token: SeDebugPrivilege	2612	MSK203.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSK203.exe

description	pid	process	target process
PID 2800 wrote to memory of 2612	2800	MSK203.exe	MSK203.exe
PID 2800 wrote to memory of 2612	2800	MSK203.exe	MSK203.exe
PID 2800 wrote to memory of 2612	2800	MSK203.exe	MSK203.exe
PID 2800 wrote to memory of 2612	2800	MSK203.exe	MSK203.exe
PID 2800 wrote to memory of 2612	2800	MSK203.exe	MSK203.exe

C:\Users\Admin\AppData\Local\Temp\MSK203.exe
"C:\Users\Admin\AppData\Local\Temp\MSK203.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\MSK203.exe
"C:\Users\Admin\AppData\Local\Temp\MSK203.exe"
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg7CF6.tmp
Filesize
30B

MD5
f15bfdebb2df02d02c8491bde1b4e9bd

SHA1
93bd46f57c3316c27cad2605ddf81d6c0bde9301

SHA256
c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043

SHA512
1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7BD8.tmp
Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7BD8.tmp
Filesize
48B

MD5
db255f53108568593d80f2b9196f73d5

SHA1
e00bde519e33311332599680b51d6c4bdda77f8f

SHA256
46cc3e4da899bd4967072208983b1cc3f7bbfdac794a908d90e14f8dc97dd780

SHA512
5b1032ca47c32dd2d23230ad83b1ccd2f74139b7c2da086140c93896f56cc65345c25f57cd54427e5786b4cb3ec675ad10184c8018a0e11118a580a1b3c68e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7BD8.tmp
Filesize
65B

MD5
1bd5509d17a385dbcebec5b71de8dffc

SHA1
9d70c3f205dddda5e33e5de97c0a09feb6836130

SHA256
2bad3065546719b1e5ff58cb7ca6231b6cb669fb1fd06fb30102e9df00d63e60

SHA512
ca43f9d62ad2c3b950b816274869a1c0bd22b77bbb80fc810783ef23b9317362132fb2f29510bb51f4d00940d8c9038b5700560b6f1e38722b2e65037c148bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7C28.tmp
Filesize
6B

MD5
50484c19f1afdaf3841a0d821ed393d2

SHA1
c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b

SHA256
6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c

SHA512
d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7C28.tmp
Filesize
34B

MD5
2a9c98ea1aa7a05604ab51073fcd45c7

SHA1
3f970ebeb4f5ef40f8bb1e16d64ab410c3af3962

SHA256
ba493b1e2704c417662224230bffa2effae24f9fbf8c56a7bcb93ac02bc2abd9

SHA512
fe999f6186c4bb20113cfdddba193cf777941a9ce223f0c6d8f85dc5e2668df6f820922d7b75f255ec2d5355f1881f3867686363f4c5f630ffa8b48b079d7647

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl7C28.tmp
Filesize
52B

MD5
5d04a35d3950677049c7a0cf17e37125

SHA1
cafdd49a953864f83d387774b39b2657a253470f

SHA256
a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266

SHA512
c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq7C48.tmp
Filesize
37B

MD5
33aa92debcc1f60e7c5854cc89fab1fa

SHA1
dfdb911fe590e83d018b61eb13c3d804a0e61a79

SHA256
11ed97cbf6f46b9d72582a923af9ce569b7546fcc9357e317566d0b4bf0bedd1

SHA512
24c749d4f77a21d79ef28986b5e906d51b2288c5c42216a3f74a484f8949cc26f1e221a8e29e358c3783f28215bde6dd196f228089b38ea72f179ef52c0f2845

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq7C48.tmp
Filesize
60B

MD5
6905490802a6c440fab7bc3299682016

SHA1
7212e3db4f3387c8ff2daee9a94067db11a218be

SHA256
0fc3d8084bd0470747f5e0ecb10127bbf64b1b7618ab5a819db38e4b839d3451

SHA512
fcf7b1927605f76bd61d0f5c467b040f210d37ae99477f1a1984cc84037c2b7b461c668e1ba993dcb4e9393c2c7a16ac2b42ba2e97d4e18121ba18d800a04a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7C17.tmp\System.dll
Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw7C69.tmp
Filesize
43B

MD5
924122aebf09c6d89e55fdd548123413

SHA1
b99715f14cd63b9cd84deb84cdfa389b0a2e5ec1

SHA256
61367232ffb806573f0ba99436d67a8edb8a32c60538b98f89066d7d4109f285

SHA512
283648ef46023087497e3e61107dc2a9d2bd26961ec617e2d2808319f16c8477f4449b1886b3f15237e3aac48cbb3fe7adefae5a932e66f1f75d8c76dac17eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw7C69.tmp
Filesize
50B

MD5
c210fec0e2819c0fd49c34256707cfad

SHA1
dac04010f2e84da530296fe6e17539208fdf9d4e

SHA256
ebfc936b1301c1a00a61bc169fa7496b47f1edafb5b54f4b92a1891f4fd0b720

SHA512
5733cd1042985b5ea1ae64967789955a25705d3ad22f59f54b6f3d8c33727ac622fa1d769f6428beb2eb62b20ad6222082e4569879340759d8539a39acc7e9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw7C69.tmp
Filesize
56B

MD5
2c77bbd52333e4144ba070082eac42d6

SHA1
d5570ca72f198bd75e1f0d241f0dd69986877ea4

SHA256
54695e5022b16a8b57b4995eabb2d2b2212e0f3fc6ddad15cb2bbc5798fa3c04

SHA512
c800b128aee9e19cfa614be129deed3a440263ff5b58d801e4929ceebf5a930eba8efe948c70e163294a4dabe993a6dcc24f3ca3cef859877da852919dce4162

Download Submit
memory/2612-584-0x00000000380A0000-0x0000000038644000-memory.dmp

Filesize
5.6MB

Download
memory/2612-586-0x0000000071690000-0x0000000071E40000-memory.dmp

Filesize
7.7MB

Download
memory/2612-577-0x0000000076EF8000-0x0000000076EF9000-memory.dmp

Filesize
4KB

Download
memory/2612-578-0x0000000076F15000-0x0000000076F16000-memory.dmp

Filesize
4KB

Download
memory/2612-581-0x0000000076E71000-0x0000000076F91000-memory.dmp

Filesize
1.1MB

Download
memory/2612-580-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/2612-582-0x000000007169E000-0x000000007169F000-memory.dmp

Filesize
4KB

Download
memory/2612-583-0x0000000000470000-0x00000000004B4000-memory.dmp

Filesize
272KB

Download
memory/2612-594-0x0000000071690000-0x0000000071E40000-memory.dmp

Filesize
7.7MB

Download
memory/2612-593-0x000000007169E000-0x000000007169F000-memory.dmp

Filesize
4KB

Download
memory/2612-585-0x0000000038650000-0x00000000386B6000-memory.dmp

Filesize
408KB

Download
memory/2612-587-0x00000000390F0000-0x0000000039140000-memory.dmp

Filesize
320KB

Download
memory/2612-588-0x0000000039150000-0x00000000391EC000-memory.dmp

Filesize
624KB

Download
memory/2612-589-0x00000000391F0000-0x0000000039282000-memory.dmp

Filesize
584KB

Download
memory/2612-590-0x00000000392E0000-0x00000000392EA000-memory.dmp

Filesize
40KB

Download
memory/2800-576-0x0000000073CD5000-0x0000000073CD6000-memory.dmp

Filesize
4KB

Download
memory/2800-575-0x0000000076E71000-0x0000000076F91000-memory.dmp

Filesize
1.1MB

Download