agenttesla | 7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89

Analysis

max time kernel
33s
max time network
17s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe
Size

90KB
MD5

3789a874d635d0d1fd9b0e2db0bb3b64
SHA1

11f577b3dd0c4808e16b7178fa146b9e9e329e2e
SHA256

7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89
SHA512

8d5485baa4c96f4e382466b2d2458a67d3d692d96ac8af2ac4478744d60f096400f34df4ed56981e43374169e7daafaaf9295c6f41e4592f8de22fa680c452ef
SSDEEP

1536:LOhNcZESviFQzXblXAorYfwJcxSTlWoJl0ovJvWR4jmft2Ib7ADUzq5K:LObcZ36ykDxSTlWoJl0ovJvWR46fJb7P

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
coleoffice.shop
Port:
587
Username:
[email protected]
Password:
RGQjHeTCy8d7
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\booking = "C:\\Users\\Admin\\AppData\\Roaming\\booking.exe"	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2788	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe
2788	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe
Token: SeDebugPrivilege	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe
Token: SeDebugPrivilege	2788	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28
PID 2380 wrote to memory of 2788	2380	7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe	28

C:\Users\Admin\AppData\Local\Temp\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe
"C:\Users\Admin\AppData\Local\Temp\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe
  "C:\Users\Admin\AppData\Local\Temp\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-47-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-4895-0x0000000004FA0000-0x0000000004FF4000-memory.dmp

Filesize
336KB

Download
memory/2380-2-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-3-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download
memory/2380-4-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-5-0x0000000007610000-0x0000000007840000-memory.dmp

Filesize
2.2MB

Download
memory/2380-11-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-6-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-13-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-9-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-7-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-35-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-43-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-51-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-53-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-69-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-67-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-65-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-63-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-61-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-57-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-55-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-59-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-1-0x0000000000E90000-0x0000000000EAA000-memory.dmp

Filesize
104KB

Download
memory/2380-27-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-45-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-41-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-39-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-37-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-33-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-31-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-29-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-0-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download
memory/2380-25-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-23-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-21-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-19-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-17-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-15-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-4892-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-4894-0x0000000000D50000-0x0000000000D9C000-memory.dmp

Filesize
304KB

Download
memory/2380-4893-0x0000000004E20000-0x0000000004E8C000-memory.dmp

Filesize
432KB

Download
memory/2380-49-0x0000000007610000-0x000000000783A000-memory.dmp

Filesize
2.2MB

Download
memory/2380-4911-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2788-4913-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2788-4912-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2788-4910-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2788-4928-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download