agenttesla | b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe
Size

607KB
MD5

7831435dbf79df5631126a63a722cf35
SHA1

2380acbc54642882a4a3ebaa0a892eda4ea50b96
SHA256

b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8
SHA512

355396d92d844bc72998588bb97b61379b7799ca3b8cb1a8101ed09fc83c2999b7c6f7a820272efe860f2cf22aaf27f62320e543b7afece79df9e8e3e4c7d070
SSDEEP

12288:U0p92TpQ1USCgfrSAOsWmjWh/DEzliFDwKM7Z0l8i7ZPcflAAky+:/P8plSf2AOuGDbFDzM0q4Zkfqfy+

Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot6521856051:AAE_VqJACYh8GJnmBCYkrp8n7Ax0fW5fJ5s/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2740-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2740-20-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2740-13-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2740-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2740-7-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2740-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2740-20-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2740-13-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2740-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2740-7-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with or use KoiVM 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2864-4-0x0000000001080000-0x0000000001114000-memory.dmp	INDICATOR_EXE_Packed_KoiVM

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2740-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2740-20-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2740-13-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2740-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2740-7-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2740-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2740-20-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2740-13-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2740-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2740-7-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2740-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2740-20-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2740-13-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2740-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2740-7-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2740-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2740-20-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2740-13-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2740-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2740-7-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2372 powershell.exe

pid	process
2372	powershell.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe

description	pid	process	target process
PID 2864 set thread context of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exejsc.exe

pid process

2372 powershell.exe
2740 jsc.exe
2740 jsc.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exejsc.exe

description pid process

Token: SeDebugPrivilege 2372 powershell.exe
Token: SeDebugPrivilege 2740 jsc.exe

pid	process
2372	powershell.exe
2740	jsc.exe
2740	jsc.exe

description	pid	process
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2740	jsc.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe

description	pid	process	target process
PID 2864 wrote to memory of 2372	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	powershell.exe
PID 2864 wrote to memory of 2372	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	powershell.exe
PID 2864 wrote to memory of 2372	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	powershell.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2740	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	jsc.exe
PID 2864 wrote to memory of 2672	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	WerFault.exe
PID 2864 wrote to memory of 2672	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	WerFault.exe
PID 2864 wrote to memory of 2672	2864	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe	WerFault.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe

C:\Users\Admin\AppData\Local\Temp\b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe
"C:\Users\Admin\AppData\Local\Temp\b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8.exe" -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2864 -s 684
2⤵
PID:2672

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-21-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/2372-23-0x0000000002B80000-0x0000000002B88000-memory.dmp

Filesize
32KB

Download
memory/2372-22-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2740-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2740-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2740-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2740-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2740-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2740-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2740-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2740-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2864-3-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2864-0-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/2864-4-0x0000000001080000-0x0000000001114000-memory.dmp

Filesize
592KB

Download
memory/2864-2-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2864-1-0x00000000011A0000-0x00000000011AC000-memory.dmp

Filesize
48KB

Download
memory/2864-24-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/2864-25-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads