agenttesla | 8d48681090810cf096230ac8e6900c4cdb22d9872622ba55f9d70c1c1ca32956

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win64.PWSX-gen.16698.exe
Size

2.5MB
MD5

3a1b81c6763af1d0d35082ee119c731a
SHA1

de17332d6c29afd205611f1abfecee207a91bc7d
SHA256

8d48681090810cf096230ac8e6900c4cdb22d9872622ba55f9d70c1c1ca32956
SHA512

03494a5db06028f23c4cb77ac574e348f1374a66ccb43236fa09fbc0423dc98c21cd618210bc1a52e88c194c3786e8cd58511c8ae12632e03fed1371df2c541f
SSDEEP

24576:7qCdMP5SdezpyFNrhSCPuoX0k6O2BusxExVJhewLg31+mYGnKBF1JETXHOa/8+UW:7P6hSrcCPT0JwLg31+mYGnKDkTXph

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
@#Qwerty12345
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

AddInProcess32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost\\svchost.exe"	AddInProcess32.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win64.PWSX-gen.16698.exe

description pid process target process

PID 1612 set thread context of 2116 1612 SecuriteInfo.com.Win64.PWSX-gen.16698.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exe

pid process

2116 AddInProcess32.exe
2116 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AddInProcess32.exe

description pid process

Token: SeDebugPrivilege 2116 AddInProcess32.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 1612 set thread context of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe

pid	process
2116	AddInProcess32.exe
2116	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2116	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SecuriteInfo.com.Win64.PWSX-gen.16698.exe

description	pid	process	target process
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe
PID 1612 wrote to memory of 2116	1612	SecuriteInfo.com.Win64.PWSX-gen.16698.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.16698.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.16698.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2116-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2116-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2116-5-0x000000007405E000-0x000000007405F000-memory.dmp

Filesize
4KB

Download
memory/2116-6-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2116-8-0x000000007405E000-0x000000007405F000-memory.dmp

Filesize
4KB

Download
memory/2116-9-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download