agenttesla | 081dd79296579ad32573e124c60b6dd78cdf5a9591198ea4028ad890a4773dab

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
081dd79296579ad32573e124c60b6dd78cdf5a9591198ea4028ad890a4773dab.vbs
Size 1.3MB
Sample240608-b7cmcafd2s
SHA256 081dd79296579ad32573e124c60b6dd78cdf5a9591198ea4028ad890a4773dab
MD5 679d86507471cd66f0ba42671aa7de5a
SHA1 9b849cc5235e1ca674a0aa41dc2d6dc6fcc88ebf
SHA512 064d164926a5bb8e0609846df4859260aa4668a2dcbcb4cf0ada408ea4a2f771aaa8b440e5bb496814b659d697e8a2ef88907c96c30d7dd183ff916107d840a4
SSDEEP 6144:DGcHdmE4nFIZxCjmlWMBF8xqgNDjgXn5cEs/DITEDpdatrkEnOIVBOHaJVXqbQ5E:Dn0Sva4NzNjq51Qca8r/FtQK/uu/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.jeepcommerce.rs
Port
21
Username
[email protected]
Password
QtU[bF0Zo#+M

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.jeepcommerce.rs
Port
21
Username
[email protected]
Password
QtU[bF0Zo#+M

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3696	x.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3696 set thread context of 1092	3696	x.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	cvtres.exe
1092	cvtres.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	cvtres.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 3696	4344	WScript.exe	84
PID 4344 wrote to memory of 3696	4344	WScript.exe	84
PID 4344 wrote to memory of 3696	4344	WScript.exe	84
PID 3696 wrote to memory of 1092	3696	x.exe	94
PID 3696 wrote to memory of 1092	3696	x.exe	94
PID 3696 wrote to memory of 1092	3696	x.exe	94
PID 3696 wrote to memory of 1092	3696	x.exe	94
PID 3696 wrote to memory of 1092	3696	x.exe	94
PID 3696 wrote to memory of 1092	3696	x.exe	94
PID 3696 wrote to memory of 1092	3696	x.exe	94
PID 3696 wrote to memory of 1092	3696	x.exe	94

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\081dd79296579ad32573e124c60b6dd78cdf5a9591198ea4028ad890a4773dab.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 907KB
SHA256 4b5e87cc2c9d2f72a63f420deb16beb797512ea5c7143a064461ba5a79ae3f00
MD5 20ddc5dfe5c14d2846aa5862acf20a4f
SHA1 3a37c924b272835c253bea08c0570d1a02e263cf
SHA512 57c03c4d0671a411b2051b147ee4b83a5afecb9ec4b7bf7d874f284bc2ebd7cc8fb61445e8f92f7fcd6dcd8b8bca9de52e224d23ed6ceffe54cf5c9d12f4f37f
SSDEEP 6144:kwRkLQVNpLhhay62nCudQmzP5l9JgYEAXJXbAXAGXeJ8cLcYcHFXXvQXX0XXJJkv:kg9+jRrd67ZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-13-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1092-15-0x0000000074780000-0x000000007482B000-memory.dmp

Download

memory/1092-16-0x0000000005590000-0x0000000005B34000-memory.dmp

Download

memory/1092-17-0x00000000051B0000-0x0000000005216000-memory.dmp

Download

memory/1092-18-0x0000000006470000-0x00000000064C0000-memory.dmp

Download

memory/1092-19-0x0000000006560000-0x00000000065FC000-memory.dmp

Download

memory/1092-20-0x00000000066A0000-0x0000000006732000-memory.dmp

Download

memory/1092-21-0x0000000006620000-0x000000000662A000-memory.dmp

Download

memory/1092-22-0x0000000074780000-0x000000007482B000-memory.dmp

Download

memory/3696-11-0x000000007482E000-0x000000007482F000-memory.dmp

Download

memory/3696-12-0x0000000000420000-0x000000000050A000-memory.dmp

Download