agenttesla | 8d48681090810cf096230ac8e6900c4cdb22d9872622ba55f9d70c1c1ca32956

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe
Size

2.5MB
MD5

3a1b81c6763af1d0d35082ee119c731a
SHA1

de17332d6c29afd205611f1abfecee207a91bc7d
SHA256

8d48681090810cf096230ac8e6900c4cdb22d9872622ba55f9d70c1c1ca32956
SHA512

03494a5db06028f23c4cb77ac574e348f1374a66ccb43236fa09fbc0423dc98c21cd618210bc1a52e88c194c3786e8cd58511c8ae12632e03fed1371df2c541f
SSDEEP

24576:7qCdMP5SdezpyFNrhSCPuoX0k6O2BusxExVJhewLg31+mYGnKBF1JETXHOa/8+UW:7P6hSrcCPT0JwLg31+mYGnKDkTXph

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
@#Qwerty12345
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

AddInProcess32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost\\svchost.exe"	AddInProcess32.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe

description pid process target process

PID 492 set thread context of 1700 492 SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exe

pid process

1700 AddInProcess32.exe
1700 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AddInProcess32.exe

description pid process

Token: SeDebugPrivilege 1700 AddInProcess32.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process	target process
PID 492 set thread context of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe

pid	process
1700	AddInProcess32.exe
1700	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	1700	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe

description	pid	process	target process
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe
PID 492 wrote to memory of 1700	492	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1700-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1700-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1700-5-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

Filesize
4KB

Download
memory/1700-6-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/1700-8-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

Filesize
4KB

Download
memory/1700-9-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download