agenttesla | 25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
Size 939KB
Sample240604-bkcc3agg36
SHA256 25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d
MD5 e028a9d3b2440ad3ff1542e3c2ae8dac
SHA1 ed6965a89ff1f27fecd0b25560410287588dbec3
SHA512 ee1c513a320c2b39016907a36f86493af9b4b73ae42216d78d68e4978df044dfa6878c1441992a5ee1ca6d9c6ce2d7e15a5959f99d93d6b113211e5b5840bec9
SSDEEP 12288:YhX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBHCcDTTNN1wd9lK3:a0DUY7TsfdHaoUR818CyPY8JutKYGXX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.nsoftonline.com
Port
587
Username
[email protected]
Password
Twenty4!!!!
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 1 IoCs

pid	Process
3088	teams.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\recc = "C:\\Users\\Admin\\AppData\\Roaming\\teams.exe"	reg.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	api.ipify.org
51	api.ipify.org
52	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3088 set thread context of 1648	3088	teams.exe	116

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2372	PING.EXE
1708	PING.EXE
1296	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
3088	teams.exe
3088	teams.exe
3088	teams.exe
1648	InstallUtil.exe
1648	InstallUtil.exe
1648	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
Token: SeDebugPrivilege	3088	teams.exe
Token: SeDebugPrivilege	1648	InstallUtil.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3876	1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	102
PID 1056 wrote to memory of 3876	1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	102
PID 1056 wrote to memory of 3876	1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	102
PID 3876 wrote to memory of 2372	3876	cmd.exe	104
PID 3876 wrote to memory of 2372	3876	cmd.exe	104
PID 3876 wrote to memory of 2372	3876	cmd.exe	104
PID 1056 wrote to memory of 3120	1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	106
PID 1056 wrote to memory of 3120	1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	106
PID 1056 wrote to memory of 3120	1056	25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe	106
PID 3120 wrote to memory of 1708	3120	cmd.exe	108
PID 3120 wrote to memory of 1708	3120	cmd.exe	108
PID 3120 wrote to memory of 1708	3120	cmd.exe	108
PID 3876 wrote to memory of 880	3876	cmd.exe	111
PID 3876 wrote to memory of 880	3876	cmd.exe	111
PID 3876 wrote to memory of 880	3876	cmd.exe	111
PID 3120 wrote to memory of 1296	3120	cmd.exe	112
PID 3120 wrote to memory of 1296	3120	cmd.exe	112
PID 3120 wrote to memory of 1296	3120	cmd.exe	112
PID 3120 wrote to memory of 3088	3120	cmd.exe	115
PID 3120 wrote to memory of 3088	3120	cmd.exe	115
PID 3120 wrote to memory of 3088	3120	cmd.exe	115
PID 3088 wrote to memory of 1648	3088	teams.exe	116
PID 3088 wrote to memory of 1648	3088	teams.exe	116
PID 3088 wrote to memory of 1648	3088	teams.exe	116
PID 3088 wrote to memory of 1648	3088	teams.exe	116
PID 3088 wrote to memory of 1648	3088	teams.exe	116
PID 3088 wrote to memory of 1648	3088	teams.exe	116
PID 3088 wrote to memory of 1648	3088	teams.exe	116
PID 3088 wrote to memory of 1648	3088	teams.exe	116

C:\Users\Admin\AppData\Local\Temp\25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe
"C:\Users\Admin\AppData\Local\Temp\25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "recc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\teams.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 9
    3⤵
    - Runs ping.exe
    PID:2372
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "recc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\teams.exe"
    3⤵
    - Adds Run key to start application
    PID:880
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 19 > nul && copy "C:\Users\Admin\AppData\Local\Temp\25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d.exe" "C:\Users\Admin\AppData\Roaming\teams.exe" && ping 127.0.0.1 -n 19 > nul && "C:\Users\Admin\AppData\Roaming\teams.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 19
    3⤵
    - Runs ping.exe
    PID:1708
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 19
    3⤵
    - Runs ping.exe
    PID:1296
- - C:\Users\Admin\AppData\Roaming\teams.exe
    "C:\Users\Admin\AppData\Roaming\teams.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

teams.exe

Path C:\Users\Admin\AppData\Roaming\teams.exe
Size 939KB
SHA256 25468bad14e7c3d5f9bf180937baec5220c43d18007a7cee1f98f1065237ac0d
MD5 e028a9d3b2440ad3ff1542e3c2ae8dac
SHA1 ed6965a89ff1f27fecd0b25560410287588dbec3
SHA512 ee1c513a320c2b39016907a36f86493af9b4b73ae42216d78d68e4978df044dfa6878c1441992a5ee1ca6d9c6ce2d7e15a5959f99d93d6b113211e5b5840bec9
SSDEEP 12288:YhX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBHCcDTTNN1wd9lK3:a0DUY7TsfdHaoUR818CyPY8JutKYGXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1056-5-0x0000000005E10000-0x0000000005E54000-memory.dmp

Download

memory/1056-3-0x0000000005350000-0x00000000058F4000-memory.dmp

Download

memory/1056-4-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/1056-0-0x000000007521E000-0x000000007521F000-memory.dmp

Download

memory/1056-6-0x0000000005F30000-0x0000000005FC2000-memory.dmp

Download

memory/1056-7-0x00000000061D0000-0x00000000061DA000-memory.dmp

Download

memory/1056-8-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/1056-10-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/1056-1-0x0000000000510000-0x0000000000602000-memory.dmp

Download

memory/1056-2-0x0000000004CE0000-0x0000000004D7C000-memory.dmp

Download

memory/1648-23-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1648-27-0x0000000008530000-0x0000000008580000-memory.dmp

Download

memory/1648-26-0x0000000005010000-0x0000000005076000-memory.dmp

Download

memory/3088-17-0x0000000000BE0000-0x0000000000CD2000-memory.dmp

Download

memory/3088-20-0x0000000006AE0000-0x0000000006AE6000-memory.dmp

Download

memory/3088-21-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/3088-22-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/3088-19-0x0000000006500000-0x000000000651A000-memory.dmp

Download

memory/3088-25-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/3088-16-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/3088-18-0x00000000751E0000-0x0000000075990000-memory.dmp

Download