agenttesla | b86258bbf5182d3da8292cbff6262a90cef9dd418fd8b6706fde5747662da2ae

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shipping Documents inv. 523435300XX.exe
Size

1.1MB
MD5

efae427357884a8d496facd0298f6af8
SHA1

a69384c7d0d889050d55e557b51e97aa8a3554f7
SHA256

b86258bbf5182d3da8292cbff6262a90cef9dd418fd8b6706fde5747662da2ae
SHA512

fa5c041de19a1c812351cad0eb2b040677584969838f37e4e752e9abb85c9db78488f5371015d08e39a33dcbddbc9292f28da23fddea1c5dbfab1ea252ef3a52
SSDEEP

24576:NAHnh+eWsN3skA4RV1Hom2KXMmHazOnIiLQiAQJGyzq925:sh+ZkldoPK8YazOIiLQiRYyzV

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\jBpFfg = "C:\\Users\\Admin\\AppData\\Roaming\\jBpFfg\\jBpFfg.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 2616	3024	Shipping Documents inv. 523435300XX.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	RegSvcs.exe
2616	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2240	Shipping Documents inv. 523435300XX.exe
3024	Shipping Documents inv. 523435300XX.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2240	Shipping Documents inv. 523435300XX.exe
2240	Shipping Documents inv. 523435300XX.exe
3024	Shipping Documents inv. 523435300XX.exe
3024	Shipping Documents inv. 523435300XX.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2240	Shipping Documents inv. 523435300XX.exe
2240	Shipping Documents inv. 523435300XX.exe
3024	Shipping Documents inv. 523435300XX.exe
3024	Shipping Documents inv. 523435300XX.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1664	2240	Shipping Documents inv. 523435300XX.exe	28
PID 2240 wrote to memory of 1664	2240	Shipping Documents inv. 523435300XX.exe	28
PID 2240 wrote to memory of 1664	2240	Shipping Documents inv. 523435300XX.exe	28
PID 2240 wrote to memory of 1664	2240	Shipping Documents inv. 523435300XX.exe	28
PID 2240 wrote to memory of 1664	2240	Shipping Documents inv. 523435300XX.exe	28
PID 2240 wrote to memory of 1664	2240	Shipping Documents inv. 523435300XX.exe	28
PID 2240 wrote to memory of 1664	2240	Shipping Documents inv. 523435300XX.exe	28
PID 2240 wrote to memory of 3024	2240	Shipping Documents inv. 523435300XX.exe	29
PID 2240 wrote to memory of 3024	2240	Shipping Documents inv. 523435300XX.exe	29
PID 2240 wrote to memory of 3024	2240	Shipping Documents inv. 523435300XX.exe	29
PID 2240 wrote to memory of 3024	2240	Shipping Documents inv. 523435300XX.exe	29
PID 3024 wrote to memory of 2616	3024	Shipping Documents inv. 523435300XX.exe	30
PID 3024 wrote to memory of 2616	3024	Shipping Documents inv. 523435300XX.exe	30
PID 3024 wrote to memory of 2616	3024	Shipping Documents inv. 523435300XX.exe	30
PID 3024 wrote to memory of 2616	3024	Shipping Documents inv. 523435300XX.exe	30
PID 3024 wrote to memory of 2616	3024	Shipping Documents inv. 523435300XX.exe	30
PID 3024 wrote to memory of 2616	3024	Shipping Documents inv. 523435300XX.exe	30
PID 3024 wrote to memory of 2616	3024	Shipping Documents inv. 523435300XX.exe	30
PID 3024 wrote to memory of 2616	3024	Shipping Documents inv. 523435300XX.exe	30

C:\Users\Admin\AppData\Local\Temp\Shipping Documents inv. 523435300XX.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents inv. 523435300XX.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Shipping Documents inv. 523435300XX.exe"
  2⤵
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\Shipping Documents inv. 523435300XX.exe
  "C:\Users\Admin\AppData\Local\Temp\Shipping Documents inv. 523435300XX.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\Shipping Documents inv. 523435300XX.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mazatl

Filesize
262KB

MD5
3f047303760afca71ab384fa17c9bc3c

SHA1
4ee410854754514bdedef869996a4bd60ce523b2

SHA256
94c2055511abb4977ef0dfaa86c31eddd5b33a3c54a36f80d22a4fdebab94603

SHA512
6fdcc7eb1fb84aaae3cf353758a46a84ede5ac76d88281f2c8f971240139f92ff2d1bcdeec7f7bfbd7f88322a23e38b4660d5bf29cff5e7bc9c7bdb790b1bf37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mazatl

Filesize
262KB

MD5
d5502a154cda81ef84937cbadfb0b903

SHA1
0d71ed2fd1095d422c4869618ce6820b5e2d32c4

SHA256
a7d3016a4769b885f55436a7dd9fae812ae34ef256fe339dd18d170db05e6344

SHA512
2a9c362aefe1967987be6e654041a6cc89af876647f8d14d216f016caca8e42c0b64ca744ae5b443e090d5a18f8720e7726f001859c97e6515d531ef9951f923

Download Submit
memory/2240-11-0x00000000001A0000-0x00000000001A4000-memory.dmp

Filesize
16KB

Download
memory/2616-77-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-28-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2616-27-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2616-29-0x0000000073D6E000-0x0000000073D6F000-memory.dmp

Filesize
4KB

Download
memory/2616-30-0x0000000000570000-0x00000000005C4000-memory.dmp

Filesize
336KB

Download
memory/2616-31-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-32-0x0000000000C90000-0x0000000000CE2000-memory.dmp

Filesize
328KB

Download
memory/2616-33-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-230-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-89-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-69-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-55-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-41-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-93-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-91-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-87-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-85-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-83-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-81-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-79-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-73-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-25-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2616-75-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-71-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-67-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-65-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-63-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-61-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-59-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-57-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-53-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-51-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-49-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-47-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-45-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-43-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-39-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-37-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-35-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-34-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Filesize
308KB

Download
memory/2616-1067-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-1069-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2616-1070-0x0000000073D6E000-0x0000000073D6F000-memory.dmp

Filesize
4KB

Download
memory/2616-1071-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download