agenttesla | a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HGF098765678000T.exe
Size 1.0MB
Sample240610-w82cbawfpk
SHA256 a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2
MD5 5de229b7fd3c91d03a721ae44214e3aa
SHA1 92c4645f075bec1f2a2285f1d3d10bb2b6cdf745
SHA512 429d56e5d2a8d828e70182febd0af1893d05d789c1a3197c808e043ee1371eed078f06114f256e6b2d9629a42143a9536dc758ca01323ecce2f032cbee2ec6f9
SSDEEP 24576:TAHnh+eWsN3skA4RV1Hom2KXMmHa3VHMYLlMVj0KKwwWO5:eh+ZkldoPK8Ya39xLWhnc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.antoniomayol.com:21
Port
21
Username
[email protected]
Password
cMhKDQUk1{;%

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vaccinatory.vbs	vaccinatory.exe

Executes dropped EXE 1 IoCs

pid	Process
1640	vaccinatory.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000022a48-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1352	1640	vaccinatory.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1352	RegSvcs.exe
1352	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1640	vaccinatory.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3768	HGF098765678000T.exe
3768	HGF098765678000T.exe
1640	vaccinatory.exe
1640	vaccinatory.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3768	HGF098765678000T.exe
3768	HGF098765678000T.exe
1640	vaccinatory.exe
1640	vaccinatory.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 1640	3768	HGF098765678000T.exe	92
PID 3768 wrote to memory of 1640	3768	HGF098765678000T.exe	92
PID 3768 wrote to memory of 1640	3768	HGF098765678000T.exe	92
PID 1640 wrote to memory of 1352	1640	vaccinatory.exe	93
PID 1640 wrote to memory of 1352	1640	vaccinatory.exe	93
PID 1640 wrote to memory of 1352	1640	vaccinatory.exe	93
PID 1640 wrote to memory of 1352	1640	vaccinatory.exe	93

C:\Users\Admin\AppData\Local\Temp\HGF098765678000T.exe
"C:\Users\Admin\AppData\Local\Temp\HGF098765678000T.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\derogates\vaccinatory.exe
  "C:\Users\Admin\AppData\Local\Temp\HGF098765678000T.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\HGF098765678000T.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4156,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
1⤵
PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

demonetising

Path C:\Users\Admin\AppData\Local\Temp\demonetising
Size 239KB
SHA256 ee563a5c91bee5bf6c734e0d209f8bf71b9aaa02e2ab07e5edde0a6acdfac71f
MD5 ba728d773dbf222d4886eaccc0ee9675
SHA1 73a39521a40e45eac8354974d4e0e3338776dd87
SHA512 25dd61ef0027ec38c732db296f0f1f16f68efc457ad8990f27e459edb0e70bfbd9396e3a64ee06b120b4f5c7670d547ff681fad1c3eea05f3466f14a6105f60f
SSDEEP 6144:6HKaYTkC8GU23wCDswWuC1qO9UNfe4K6Wz2gbt+WI5TXVmZ1p6SFS/V1m8A+vY8q:fU8swm8eDaHucRNUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

lophophorine

Path C:\Users\Admin\AppData\Local\Temp\lophophorine
Size 29KB
SHA256 d3662a783a7c79739d2133ad366add13c2899a17b078dfc78549e94ba5206e74
MD5 548c2148e266f939ea755be386cff149
SHA1 ad4472fcc66e6622867dc55724dbdbb2fbdeccdb
SHA512 89192f052a38eabe8ecfae6adb26021731ed211b14284b02e0c947ca77cce8152fbe0c5d405dd72c93e39dcdc346764d4e6e991286687761529f3df7cb97d2f9
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNb5+IyX5Q4vfF3if6gySS:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

vaccinatory.exe

Path C:\Users\Admin\AppData\Local\derogates\vaccinatory.exe
Size 1.0MB
SHA256 a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2
MD5 5de229b7fd3c91d03a721ae44214e3aa
SHA1 92c4645f075bec1f2a2285f1d3d10bb2b6cdf745
SHA512 429d56e5d2a8d828e70182febd0af1893d05d789c1a3197c808e043ee1371eed078f06114f256e6b2d9629a42143a9536dc758ca01323ecce2f032cbee2ec6f9
SSDEEP 24576:TAHnh+eWsN3skA4RV1Hom2KXMmHa3VHMYLlMVj0KKwwWO5:eh+ZkldoPK8Ya39xLWhnc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1352-30-0x0000000005C00000-0x00000000061A4000-memory.dmp

Download

memory/1352-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1352-29-0x000000007480E000-0x000000007480F000-memory.dmp

Download

memory/1352-31-0x0000000005510000-0x0000000005576000-memory.dmp

Download

memory/1352-32-0x0000000074800000-0x0000000074FB0000-memory.dmp

Download

memory/1352-33-0x0000000006910000-0x0000000006960000-memory.dmp

Download

memory/1352-34-0x0000000006AB0000-0x0000000006B42000-memory.dmp

Download

memory/1352-35-0x00000000069B0000-0x00000000069BA000-memory.dmp

Download

memory/1352-36-0x000000007480E000-0x000000007480F000-memory.dmp

Download

memory/1352-37-0x0000000074800000-0x0000000074FB0000-memory.dmp

Download

memory/3768-10-0x00000000007C0000-0x00000000007C4000-memory.dmp

Download