agenttesla | c142a7875039a8af01ec186af4d76d27f5b0d6454e80533a1e6c76b425c1b43a

Analysis

max time kernel
103s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe
Size 1.0MB
Sample240608-c4s1lagf83
SHA256 e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a
MD5 29b2b081df5861fed9651766f37b7738
SHA1 656957b9e2b270b59b3750cb90978e496d9177fe
SHA512 828edb2157a3f293f92563729e17292310f525a9e4d0f66ed491dacc0f1058a85ec9bf5466de1dc98712ae0686eed4fb8b356bfa8df1e47b5ca9d205561dac5f
SSDEEP 24576:aAHnh+eWsN3skA4RV1Hom2KXMmHaRLSomGr7yXUR5:th+ZkldoPK8YaRLSomne
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
^NpBYBQ0
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
2360	name.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mpTrle = "C:\\Users\\Admin\\AppData\\Roaming\\mpTrle\\mpTrle.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000b00000002336d-12.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 3500	2360	name.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3500	RegSvcs.exe
3500	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2360	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2844	e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe
2844	e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe
2360	name.exe
2360	name.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2844	e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe
2844	e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe
2360	name.exe
2360	name.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2360	2844	e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe	84
PID 2844 wrote to memory of 2360	2844	e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe	84
PID 2844 wrote to memory of 2360	2844	e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe	84
PID 2360 wrote to memory of 3500	2360	name.exe	85
PID 2360 wrote to memory of 3500	2360	name.exe	85
PID 2360 wrote to memory of 3500	2360	name.exe	85
PID 2360 wrote to memory of 3500	2360	name.exe	85

C:\Users\Admin\AppData\Local\Temp\e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe
"C:\Users\Admin\AppData\Local\Temp\e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

camellin

Path C:\Users\Admin\AppData\Local\Temp\camellin
Size 236KB
SHA256 ead5f91aee87543ea50fdce3fd9aefa04633b0e4fde9795280685fae23a73c27
MD5 51b40dd83583fea3de44c6d917ec1168
SHA1 229ffac32085b9291255bd8a8e3e463b55c816bf
SHA512 b750ae1d73d02c702d646d430d64641d2f425558866e65634ddc6f1c53ed326aa66c10dd9633723e2adc230a529cd75bd6f4c05be31fc986fc99de3ab9b412e6
SSDEEP 3072:K0g8J4SFzZOiIoaRGafkiIJmp0zqQHbf2WkyyfzlsXTf/a9QqPZsazINJizt8cOd:KaJ4u0KiIJA0+fAklsu3INJih/XVIv
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.0MB
SHA256 e7f83d43899e14d39467f1c25170cc0215bda6c7e99986285b6833642654d03a
MD5 29b2b081df5861fed9651766f37b7738
SHA1 656957b9e2b270b59b3750cb90978e496d9177fe
SHA512 828edb2157a3f293f92563729e17292310f525a9e4d0f66ed491dacc0f1058a85ec9bf5466de1dc98712ae0686eed4fb8b356bfa8df1e47b5ca9d205561dac5f
SSDEEP 24576:aAHnh+eWsN3skA4RV1Hom2KXMmHaRLSomGr7yXUR5:th+ZkldoPK8YaRLSomne
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2844-10-0x00000000022F0000-0x00000000022F4000-memory.dmp

Download

memory/3500-30-0x0000000005FE0000-0x0000000006584000-memory.dmp

Download

memory/3500-29-0x00000000752BE000-0x00000000752BF000-memory.dmp

Download

memory/3500-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3500-31-0x0000000005980000-0x00000000059E6000-memory.dmp

Download

memory/3500-32-0x00000000752B0000-0x0000000075A60000-memory.dmp

Download

memory/3500-34-0x0000000006E70000-0x0000000006EC0000-memory.dmp

Download

memory/3500-35-0x0000000006F60000-0x0000000006FF2000-memory.dmp

Download

memory/3500-36-0x0000000006F00000-0x0000000006F0A000-memory.dmp

Download

memory/3500-37-0x00000000752BE000-0x00000000752BF000-memory.dmp

Download

memory/3500-38-0x00000000752B0000-0x0000000075A60000-memory.dmp

Download