agenttesla | 5913da48fc0d4ebca6645a34254cb3a8a594841cd0b31b4e728b329b3a165498

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER060424.exe
Size 779KB
Sample240604-hd2spsgh42
SHA256 5913da48fc0d4ebca6645a34254cb3a8a594841cd0b31b4e728b329b3a165498
MD5 91d0aec526e4b4a34bb5eedad145979f
SHA1 37a0d3a33cea49264a9a48315720bd82e59a3f32
SHA512 47bc09ed2d55aca56275b74b2ed910ee08288b13fff74c7fa4f1d6f8efa1c649cccb0a88fb31ce73b3666e094d914d4e1b7d346c6b4c4d0bd2c141339fd360e9
SSDEEP 12288:Sr/cKNr+u9WiU0T2I1VPja54TDa+ZghRONDVfEFvIblKbVmmN28YkR:MbCunV1VPjxK+ZgiRVfEI8VA+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.formosabag.co.id
Port
587
Username
[email protected]
Password
@2022exim02^^**
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2700	powershell.exe
2344	powershell.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\YxAesh = "C:\\Users\\Admin\\AppData\\Roaming\\YxAesh\\YxAesh.exe"	ORDER060424.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org
7	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 1976	2228	ORDER060424.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2208	schtasks.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	ORDER060424.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d461d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67080b00000001000000140000005500530045005200540072007500730074000000140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8090000000100000016000000301406082b0601050507030306082b060105050703080f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	ORDER060424.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	ORDER060424.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2228	ORDER060424.exe
2228	ORDER060424.exe
1976	ORDER060424.exe
1976	ORDER060424.exe
2344	powershell.exe
2700	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	ORDER060424.exe
Token: SeDebugPrivilege	1976	ORDER060424.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	ORDER060424.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2700	2228	ORDER060424.exe	28
PID 2228 wrote to memory of 2700	2228	ORDER060424.exe	28
PID 2228 wrote to memory of 2700	2228	ORDER060424.exe	28
PID 2228 wrote to memory of 2700	2228	ORDER060424.exe	28
PID 2228 wrote to memory of 2344	2228	ORDER060424.exe	30
PID 2228 wrote to memory of 2344	2228	ORDER060424.exe	30
PID 2228 wrote to memory of 2344	2228	ORDER060424.exe	30
PID 2228 wrote to memory of 2344	2228	ORDER060424.exe	30
PID 2228 wrote to memory of 2208	2228	ORDER060424.exe	32
PID 2228 wrote to memory of 2208	2228	ORDER060424.exe	32
PID 2228 wrote to memory of 2208	2228	ORDER060424.exe	32
PID 2228 wrote to memory of 2208	2228	ORDER060424.exe	32
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34
PID 2228 wrote to memory of 1976	2228	ORDER060424.exe	34

C:\Users\Admin\AppData\Local\Temp\ORDER060424.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER060424.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ORDER060424.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VrTNGoTFpBWbf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VrTNGoTFpBWbf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4290.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\ORDER060424.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER060424.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar180A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar180A.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4290.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4290.tmp
Size 1KB
SHA256 7826fd56a6bbcacdbed7105a3ca574a7d63cc90aae22436dff4e77c6f221d3f4
MD5 d2119bef8b22237d2a1a09e488dcf563
SHA1 fa60f17132df8856bb3875c0728cd030a201790b
SHA512 eb9f8557ca25f611dff27dc8447a998eb5415e463235e2bb74ab929cd906e3d4b1a0a2aab08a11147088053b884f38b0531fb3733830199c43ea53e9ecee9ad6
MD5 SHA1 SHA512

Submit Download

B5NHK9MXZ4JDDH6C847S.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B5NHK9MXZ4JDDH6C847S.temp
Size 7KB
SHA256 5da25bff746cc93605a3085a0057de8ac418afcd80f569e82bd9b0921bc5728a
MD5 ae4a82410931a506ab28c65306a9a256
SHA1 cc990004c409cc0f06f4c43bab425d5ff94a50b9
SHA512 6f9f2b40dda0a2758c467257169b8dc5dde318602826ac8aae4983c48f0437a253d77dae6e69c42508c3927f99752bc972e79ea709c73ea4e345151c3cbc81fa
SSDEEP 96:jEh2ClM80nqvsqvJCwocEh2ClM80nqvsEHyqvJCwormsfbQHup7jHXlUVI:4r4Uozr4AHnorm07p7jHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1976-125-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1976-128-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1976-119-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1976-120-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1976-124-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1976-126-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1976-122-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1976-117-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2228-1-0x0000000000FE0000-0x00000000010A4000-memory.dmp

Download

memory/2228-2-0x0000000074460000-0x0000000074B4E000-memory.dmp

Download

memory/2228-100-0x0000000000A50000-0x0000000000A66000-memory.dmp

Download

memory/2228-0-0x000000007446E000-0x000000007446F000-memory.dmp

Download

memory/2228-103-0x0000000005B40000-0x0000000005BC4000-memory.dmp

Download

memory/2228-102-0x0000000000B60000-0x0000000000B70000-memory.dmp

Download

memory/2228-101-0x0000000000A70000-0x0000000000A7E000-memory.dmp

Download

memory/2228-129-0x0000000074460000-0x0000000074B4E000-memory.dmp

Download