agenttesla | 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Due Invoice pdf.exe
Size 196KB
Sample240529-netrdade26
SHA256 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d
MD5 06f89bea6cec0ee3459c26732c6f4d40
SHA1 077c773301223d98b07630487facd24710353335
SHA512 a172753e363467928c9bf700f36865eb53ab5ea85dcbf7bb3fa8bc756f130eacf3ba194f8b25707203b55e8b84a256f756e27a17cce4f81991e9cc2c31353d6b
SSDEEP 3072:gpFMiA1m+CfRqBpLd0aTUWs+zZl1/eSFZQ0xw5W1LvTFH:gpfqRCfsppZlBvvw5WNRH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla xworm keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
jahnindustry.shop
Port
587
Username
[email protected]
Password
WmfkJ55yPdtj
Email to
[email protected]

Extracted

Family

xworm

Version

178.215.236.251:717

Mutex

0AVeWj1eTvHM3Un2

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2128-9821-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	RegAsm.exe

Executes dropped EXE 1 IoCs

pid	Process
3272	Pdmyfgbmmsc.exe

Loads dropped DLL 2 IoCs

pid	Process
2868	Due Invoice pdf.exe
2128	RegAsm.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe"	Due Invoice pdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe"	Pdmyfgbmmsc.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org
9	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 3328	2868	Due Invoice pdf.exe	30
PID 3272 set thread context of 2128	3272	Pdmyfgbmmsc.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3328	RegAsm.exe
3328	RegAsm.exe
2128	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	Due Invoice pdf.exe
Token: SeDebugPrivilege	2868	Due Invoice pdf.exe
Token: SeDebugPrivilege	3272	Pdmyfgbmmsc.exe
Token: SeDebugPrivilege	3328	RegAsm.exe
Token: SeDebugPrivilege	3272	Pdmyfgbmmsc.exe
Token: SeDebugPrivilege	2128	RegAsm.exe
Token: SeDebugPrivilege	2128	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2128	RegAsm.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3272	2868	Due Invoice pdf.exe	29
PID 2868 wrote to memory of 3272	2868	Due Invoice pdf.exe	29
PID 2868 wrote to memory of 3272	2868	Due Invoice pdf.exe	29
PID 2868 wrote to memory of 3272	2868	Due Invoice pdf.exe	29
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 2868 wrote to memory of 3328	2868	Due Invoice pdf.exe	30
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33
PID 3272 wrote to memory of 2128	3272	Pdmyfgbmmsc.exe	33

C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
  "C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Drops startup file
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pdmyfgbmmsc.exe

Path C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
Size 195KB
SHA256 2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b
MD5 f3578e8755842b11168c9cfe8d72f51e
SHA1 5973e517739c944d5e1e269f399e7bebf33fd172
SHA512 48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29
SSDEEP 6144:2nZjuXp4tL5qjdYxdUFXfX6SzdKGZBqEJzH:qQp4tL5qjdgdU/d7BzJL
MD5 SHA1 SHA512 SSDEEP

Submit Download

findo.exe

Path \??\c:\users\admin\appdata\roaming\findo.exe
Size 196KB
SHA256 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d
MD5 06f89bea6cec0ee3459c26732c6f4d40
SHA1 077c773301223d98b07630487facd24710353335
SHA512 a172753e363467928c9bf700f36865eb53ab5ea85dcbf7bb3fa8bc756f130eacf3ba194f8b25707203b55e8b84a256f756e27a17cce4f81991e9cc2c31353d6b
SSDEEP 3072:gpFMiA1m+CfRqBpLd0aTUWs+zZl1/eSFZQ0xw5W1LvTFH:gpfqRCfsppZlBvvw5WNRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

XClient.exe

Path \Users\Admin\AppData\Roaming\XClient.exe
Size 63KB
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
SSDEEP 768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFg2SM16Iq8+SYDKHRgVijNdYLb:rYMaNylPYSAb8dBn3HcPDKHRgV7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2128-9821-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2868-47-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-4891-0x0000000005330000-0x00000000053B2000-memory.dmp

Download

memory/2868-3-0x00000000064D0000-0x0000000006716000-memory.dmp

Download

memory/2868-15-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-4-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-5-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-57-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-7-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-9-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-11-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-13-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-17-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-19-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-55-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-67-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-65-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-63-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-61-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-59-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-53-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-51-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-49-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-1-0x0000000000380000-0x00000000003B4000-memory.dmp

Download

memory/2868-45-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-2-0x0000000074A20000-0x000000007510E000-memory.dmp

Download

memory/2868-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Download

memory/2868-39-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-37-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-35-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-33-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-31-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-29-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-27-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-25-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-23-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-21-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-4890-0x0000000074A20000-0x000000007510E000-memory.dmp

Download

memory/2868-43-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/2868-4892-0x0000000004B30000-0x0000000004B7C000-memory.dmp

Download

memory/2868-4900-0x0000000005710000-0x0000000005764000-memory.dmp

Download

memory/2868-4917-0x0000000074A20000-0x000000007510E000-memory.dmp

Download

memory/2868-41-0x00000000064D0000-0x0000000006710000-memory.dmp

Download

memory/3272-4901-0x0000000000A00000-0x0000000000A32000-memory.dmp

Download

memory/3272-4904-0x0000000074A20000-0x000000007510E000-memory.dmp

Download

memory/3272-4918-0x00000000061D0000-0x00000000063F0000-memory.dmp

Download

memory/3272-9805-0x0000000005D10000-0x0000000005D6C000-memory.dmp

Download

memory/3272-9806-0x0000000074A20000-0x000000007510E000-memory.dmp

Download

memory/3272-9822-0x0000000074A20000-0x000000007510E000-memory.dmp

Download

memory/3272-4903-0x0000000074A20000-0x000000007510E000-memory.dmp

Download

memory/3328-4916-0x0000000000400000-0x0000000000440000-memory.dmp

Download