agenttesla | 9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe
Size 1.0MB
Sample240607-b4mm5sgf49
SHA256 9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e
MD5 385447b40e27d0818c34d675eb53cd78
SHA1 b00d3870d30655c67a5fc776fa5ba22bf5ed778a
SHA512 59675498fd7bd07c6452edd5c3baa33b7968a5c6bd463cb9e631a5aadbd37a86ab903728979cb43f9bdf6e6f96e6378fcbfbe05881df508d1105450c7d95784e
SSDEEP 24576:WAHnh+eWsN3skA4RV1Hom2KXMmHa/2gu4/SW6X+8aeUwjon5:xh+ZkldoPK8Ya/2a/SW6XFae6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.antoniomayol.com:21
Port
21
Username
[email protected]
Password
cMhKDQUk1{;%

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\obtenebrate.vbs	obtenebrate.exe

Executes dropped EXE 1 IoCs

pid	Process
2300	obtenebrate.exe

Loads dropped DLL 1 IoCs

pid	Process
1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0009000000014983-12.dat	autoit_exe
behavioral1/files/0x0009000000014983-16.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 2620	2300	obtenebrate.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2620	RegSvcs.exe
2620	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2300	obtenebrate.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe
1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe
2300	obtenebrate.exe
2300	obtenebrate.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe
1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe
2300	obtenebrate.exe
2300	obtenebrate.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2300	1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe	28
PID 1952 wrote to memory of 2300	1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe	28
PID 1952 wrote to memory of 2300	1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe	28
PID 1952 wrote to memory of 2300	1952	9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe	28
PID 2300 wrote to memory of 2620	2300	obtenebrate.exe	29
PID 2300 wrote to memory of 2620	2300	obtenebrate.exe	29
PID 2300 wrote to memory of 2620	2300	obtenebrate.exe	29
PID 2300 wrote to memory of 2620	2300	obtenebrate.exe	29
PID 2300 wrote to memory of 2620	2300	obtenebrate.exe	29
PID 2300 wrote to memory of 2620	2300	obtenebrate.exe	29
PID 2300 wrote to memory of 2620	2300	obtenebrate.exe	29
PID 2300 wrote to memory of 2620	2300	obtenebrate.exe	29

C:\Users\Admin\AppData\Local\Temp\9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe
"C:\Users\Admin\AppData\Local\Temp\9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\quinquennia\obtenebrate.exe
  "C:\Users\Admin\AppData\Local\Temp\9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

quinquenniad

Path C:\Users\Admin\AppData\Local\Temp\quinquenniad
Size 239KB
SHA256 df487712621a3b1bffdf58d741914dee8537ce7143be6e8ec0bbd2362f6ec229
MD5 46251313c745f5073366b7ea858a881f
SHA1 ba31734cab555bba4ab71d2924ea511fd6baa8b9
SHA512 e5c0b6c5ae925d89746da1f8023c0bdcac5f8d9cb12197b938331689f6639178206fc061c8b377868e92913d37c3bdfe63a3affe21d232a5e07aeee83eba75c6
SSDEEP 6144:kNSFaq99gfkSyYTvg/woJ7Ex71XLZxDFUFHB/6Jzx77FP:TgfRTvgfhe1F9FUFh/6rR
MD5 SHA1 SHA512 SSDEEP

Submit Download

subbase

Path C:\Users\Admin\AppData\Local\Temp\subbase
Size 29KB
SHA256 050b4df3e5287f0b95792cb62aeb2c9cead552928bfaea78ea9bd234f65102a3
MD5 918740f8734437754a3a312e9a571b57
SHA1 4599241c3fc996d93304c8084dfd12cc616df863
SHA512 5df61fc5ebdbe6312b80795b01412f39d3e6dc92090290d1815a5d9ad215926f48be61dd59cef54a93a5952833099559160fdf16d30c580bfae98e9850fad4e1
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbq+IWb4vfF3if6gygkig:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

obtenebrate.exe

Path C:\Users\Admin\AppData\Local\quinquennia\obtenebrate.exe
Size 1.0MB
SHA256 9fe32dde4aa67dd53ece471e40b336d2ca7ae07a79cecea19f86a3f771f5331e
MD5 385447b40e27d0818c34d675eb53cd78
SHA1 b00d3870d30655c67a5fc776fa5ba22bf5ed778a
SHA512 59675498fd7bd07c6452edd5c3baa33b7968a5c6bd463cb9e631a5aadbd37a86ab903728979cb43f9bdf6e6f96e6378fcbfbe05881df508d1105450c7d95784e
SSDEEP 24576:WAHnh+eWsN3skA4RV1Hom2KXMmHa/2gu4/SW6X+8aeUwjon5:xh+ZkldoPK8Ya/2a/SW6XFae6
MD5 SHA1 SHA512 SSDEEP

Submit Download

obtenebrate.exe

Path \Users\Admin\AppData\Local\quinquennia\obtenebrate.exe
Size 768KB
SHA256 2b56ec7269ae6c6f949cdcb1667b362eb267e880369be298b5beaec057aa804d
MD5 7ee0f8d04dd522dd700abdf666099a5f
SHA1 0247c182cc000d3308fffd5e2f2b18af9da2c93d
SHA512 f4d61ee2d4bbe91d60e4ee5fe73fbe62d9b4c58a48b08d9833953def26d8ab483be8b6e41c9fd7dacebf033f158e25f04196d7d5759dc093f7c853a42267b6d2
SSDEEP 12288:WAHn2JK+HemNsqI3etnBHYPpAkApyRV3jRfP4S5LH28U3mcQuKXQoggdnYga:WAHnh+eWsN3skA4RV1Hom2KXMmHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1952-10-0x0000000000620000-0x0000000000624000-memory.dmp

Download

memory/2620-32-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2620-34-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2620-35-0x000000007414E000-0x000000007414F000-memory.dmp

Download

memory/2620-30-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2620-36-0x0000000074140000-0x000000007482E000-memory.dmp

Download

memory/2620-37-0x000000007414E000-0x000000007414F000-memory.dmp

Download

memory/2620-38-0x0000000074140000-0x000000007482E000-memory.dmp

Download