agenttesla | 25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
Size 939KB
Sample240604-bkcc3agg36
SHA256 25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d
MD5 e028a9d3b2440ad3ff1542e3c2ae8dac
SHA1 ed6965a89ff1f27fecd0b25560410287588dbec3
SHA512 ee1c513a320c2b39016907a36f86493af9b4b73ae42216d78d68e4978df044dfa6878c1441992a5ee1ca6d9c6ce2d7e15a5959f99d93d6b113211e5b5840bec9
SSDEEP 12288:YhX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBHCcDTTNN1wd9lK3:a0DUY7TsfdHaoUR818CyPY8JutKYGXX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.nsoftonline.com
Port
587
Username
[email protected]
Password
Twenty4!!!!
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 1 IoCs

pid	Process
2704	teams.exe

Loads dropped DLL 2 IoCs

pid	Process
2668	cmd.exe
2668	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\recc = "C:\\Users\\Admin\\AppData\\Roaming\\teams.exe"	reg.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 2248	2704	teams.exe	39

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2052	PING.EXE
2712	PING.EXE
2660	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
2704	teams.exe
2704	teams.exe
2704	teams.exe
2704	teams.exe
2248	InstallUtil.exe
2248	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
Token: SeDebugPrivilege	2704	teams.exe
Token: SeDebugPrivilege	2248	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2248	InstallUtil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2900	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	28
PID 2756 wrote to memory of 2900	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	28
PID 2756 wrote to memory of 2900	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	28
PID 2756 wrote to memory of 2900	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	28
PID 2900 wrote to memory of 2052	2900	cmd.exe	30
PID 2900 wrote to memory of 2052	2900	cmd.exe	30
PID 2900 wrote to memory of 2052	2900	cmd.exe	30
PID 2900 wrote to memory of 2052	2900	cmd.exe	30
PID 2756 wrote to memory of 2668	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	31
PID 2756 wrote to memory of 2668	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	31
PID 2756 wrote to memory of 2668	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	31
PID 2756 wrote to memory of 2668	2756	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	31
PID 2668 wrote to memory of 2712	2668	cmd.exe	33
PID 2668 wrote to memory of 2712	2668	cmd.exe	33
PID 2668 wrote to memory of 2712	2668	cmd.exe	33
PID 2668 wrote to memory of 2712	2668	cmd.exe	33
PID 2900 wrote to memory of 2744	2900	cmd.exe	34
PID 2900 wrote to memory of 2744	2900	cmd.exe	34
PID 2900 wrote to memory of 2744	2900	cmd.exe	34
PID 2900 wrote to memory of 2744	2900	cmd.exe	34
PID 2668 wrote to memory of 2660	2668	cmd.exe	35
PID 2668 wrote to memory of 2660	2668	cmd.exe	35
PID 2668 wrote to memory of 2660	2668	cmd.exe	35
PID 2668 wrote to memory of 2660	2668	cmd.exe	35
PID 2668 wrote to memory of 2704	2668	cmd.exe	36
PID 2668 wrote to memory of 2704	2668	cmd.exe	36
PID 2668 wrote to memory of 2704	2668	cmd.exe	36
PID 2668 wrote to memory of 2704	2668	cmd.exe	36
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 2720	2704	teams.exe	37
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 3060	2704	teams.exe	38
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39
PID 2704 wrote to memory of 2248	2704	teams.exe	39

C:\Users\Admin\AppData\Local\Temp\25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
"C:\Users\Admin\AppData\Local\Temp\25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "recc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\teams.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - Runs ping.exe
    PID:2052
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "recc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\teams.exe"
    3⤵
    - Adds Run key to start application
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 11 > nul && copy "C:\Users\Admin\AppData\Local\Temp\25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe" "C:\Users\Admin\AppData\Roaming\teams.exe" && ping 127.0.0.1 -n 11 > nul && "C:\Users\Admin\AppData\Roaming\teams.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 11
    3⤵
    - Runs ping.exe
    PID:2712
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 11
    3⤵
    - Runs ping.exe
    PID:2660
- - C:\Users\Admin\AppData\Roaming\teams.exe
    "C:\Users\Admin\AppData\Roaming\teams.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:2720
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:3060
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

teams.exe

Path \Users\Admin\AppData\Roaming\teams.exe
Size 939KB
SHA256 25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d
MD5 e028a9d3b2440ad3ff1542e3c2ae8dac
SHA1 ed6965a89ff1f27fecd0b25560410287588dbec3
SHA512 ee1c513a320c2b39016907a36f86493af9b4b73ae42216d78d68e4978df044dfa6878c1441992a5ee1ca6d9c6ce2d7e15a5959f99d93d6b113211e5b5840bec9
SSDEEP 12288:YhX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBHCcDTTNN1wd9lK3:a0DUY7TsfdHaoUR818CyPY8JutKYGXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2248-46-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2248-47-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2248-45-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2248-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2704-17-0x0000000000730000-0x0000000000736000-memory.dmp

Download

memory/2704-15-0x0000000000DE0000-0x0000000000ED2000-memory.dmp

Download

memory/2704-16-0x00000000042E0000-0x00000000042FA000-memory.dmp

Download

memory/2720-24-0x0000000000090000-0x00000000000D4000-memory.dmp

Download

memory/2720-18-0x0000000000090000-0x00000000000D4000-memory.dmp

Download

memory/2720-20-0x0000000000090000-0x00000000000D4000-memory.dmp

Download

memory/2720-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2720-22-0x0000000000090000-0x00000000000D4000-memory.dmp

Download

memory/2756-0-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

Download

memory/2756-4-0x0000000074E20000-0x000000007550E000-memory.dmp

Download

memory/2756-3-0x0000000004990000-0x00000000049D4000-memory.dmp

Download

memory/2756-2-0x0000000074E20000-0x000000007550E000-memory.dmp

Download

memory/2756-1-0x0000000000D80000-0x0000000000E72000-memory.dmp

Download

memory/3060-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download