agenttesla | e3d643cbe1e13f21493f7cc9ff74d9992512a11ef7e2ff6fce988ef16b931e5d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

EBASCO TRADING PO#910333.exe
Size

789KB
MD5

b44ca4d55009a129bb3d4cfb990bca6e
SHA1

52f4931f3adec34828a887ef65edc10b1898e978
SHA256

a8970a4e1980b60ab0c3944cc63f4e32935dfee5166164c4fce000188957fa7a
SHA512

bb4af0a8e24cdccb0c272c487880f16997dd73c7e61dba38d67f828fc3dc0835b564a7e6e0bfadaa3c3af203060af69ef6668aee45a6fcc8c0daf82b0830238e
SSDEEP

24576:6dgC3c6Rf6rKInsocB7UBViajFPP+wu3HgtY+VT:6GGSMUBwajFsgtY+VT

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
Asaprocky11
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

resource	yara_rule
behavioral1/memory/2432-27-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2432-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2432-26-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2432-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2432-21-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

resource	yara_rule
behavioral1/memory/2432-27-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2432-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2432-26-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2432-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2432-21-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

resource	yara_rule
behavioral1/memory/2432-27-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2432-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2432-26-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2432-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2432-21-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2432-27-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2432-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2432-26-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2432-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2432-21-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2432-27-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2432-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2432-26-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2432-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2432-21-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2432-27-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2432-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2432-26-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2432-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2432-21-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2088	powershell.exe
2724	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1340 set thread context of 2432	1340	EBASCO TRADING PO#910333.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2724	powershell.exe
2088	powershell.exe
2432	RegSvcs.exe
2432	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2432	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	RegSvcs.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2088	1340	EBASCO TRADING PO#910333.exe	28
PID 1340 wrote to memory of 2088	1340	EBASCO TRADING PO#910333.exe	28
PID 1340 wrote to memory of 2088	1340	EBASCO TRADING PO#910333.exe	28
PID 1340 wrote to memory of 2088	1340	EBASCO TRADING PO#910333.exe	28
PID 1340 wrote to memory of 2088	1340	EBASCO TRADING PO#910333.exe	28
PID 1340 wrote to memory of 2088	1340	EBASCO TRADING PO#910333.exe	28
PID 1340 wrote to memory of 2088	1340	EBASCO TRADING PO#910333.exe	28
PID 1340 wrote to memory of 2724	1340	EBASCO TRADING PO#910333.exe	30
PID 1340 wrote to memory of 2724	1340	EBASCO TRADING PO#910333.exe	30
PID 1340 wrote to memory of 2724	1340	EBASCO TRADING PO#910333.exe	30
PID 1340 wrote to memory of 2724	1340	EBASCO TRADING PO#910333.exe	30
PID 1340 wrote to memory of 2724	1340	EBASCO TRADING PO#910333.exe	30
PID 1340 wrote to memory of 2724	1340	EBASCO TRADING PO#910333.exe	30
PID 1340 wrote to memory of 2724	1340	EBASCO TRADING PO#910333.exe	30
PID 1340 wrote to memory of 2764	1340	EBASCO TRADING PO#910333.exe	32
PID 1340 wrote to memory of 2764	1340	EBASCO TRADING PO#910333.exe	32
PID 1340 wrote to memory of 2764	1340	EBASCO TRADING PO#910333.exe	32
PID 1340 wrote to memory of 2764	1340	EBASCO TRADING PO#910333.exe	32
PID 1340 wrote to memory of 2764	1340	EBASCO TRADING PO#910333.exe	32
PID 1340 wrote to memory of 2764	1340	EBASCO TRADING PO#910333.exe	32
PID 1340 wrote to memory of 2764	1340	EBASCO TRADING PO#910333.exe	32
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34
PID 1340 wrote to memory of 2432	1340	EBASCO TRADING PO#910333.exe	34

C:\Users\Admin\AppData\Local\Temp\EBASCO TRADING PO#910333.exe
"C:\Users\Admin\AppData\Local\Temp\EBASCO TRADING PO#910333.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\EBASCO TRADING PO#910333.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RZbTEveclO.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RZbTEveclO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DFA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3DFA.tmp

Filesize
1KB

MD5
00fc98cd4b77581cc046586a77d48204

SHA1
5c4a1c8812ff7964f312108a878e9b794d666b71

SHA256
fa0524c31b7001a99dd5ba5fb8b2b920ff14e92e1758ee61bbef6c90c08db6da

SHA512
b7b54ae2a288797b7acc85f1d79259fe848a3457979fdea37b2cab2f2ffe0f3c3ff72fed29d51633a6ce30b7c8af1799e0b0f85b9f58b1447cc10e76b118282c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
07b2279cbabb7a69150e346f299c3eac

SHA1
6da2c7f8c7e539b2cfb36b079fc8c3ec5324ae55

SHA256
2fbb877cb5e7cd555b7528cb077119cdb4b130689f313b9e0e7ea4f2bd32e7f1

SHA512
dc058e82eb50bc05d9d2efe6429c895c6f8cc0576f31bbe261b05b9d3e23253bf67ca36b475d3d3b57b58450f1f959d800bd966b5c25cdbc54b49f3a6aefdde3

Download Submit
memory/1340-3-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/1340-0-0x0000000000AE0000-0x0000000000BAA000-memory.dmp

Filesize
808KB

Download
memory/1340-4-0x0000000004F00000-0x0000000004F82000-memory.dmp

Filesize
520KB

Download
memory/1340-2-0x00000000005F0000-0x00000000005FE000-memory.dmp

Filesize
56KB

Download
memory/1340-1-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download
memory/2432-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-27-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2432-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download