agenttesla | 241fa2c06ac1e04dfdd6878d8d78bae482abdecf154af78bd339fc056199590d

Analysis

max time kernel
80s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bracket Drawing & Model_934711-0001.exe
Size

767KB
MD5

ae54788d08becd55e2b37644bd3a415f
SHA1

1cfa4e42bfdb310216232b98078058613a22bd23
SHA256

19b604df73a21665949858204d634fc31077cc0b1c0c02f53712b2cf3b5e8bc0
SHA512

c12a405c4cc75c18d804c00300f4de326c1e32ddbd7dc72d11fc0ebd75aa20a59198639b7b39715bdb09e5f57285e7cc2d0118a43ea9f89dd18f956fdc0951c7
SSDEEP

12288:nbpD3HH3DI+jiNu1r3jhWvk4Zdmm8gJgoDxJ/27+LHeMbGIfauCRUDJM:bpjH3DI2DAvkwbvgoDxESCMbGIyTUFM

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mahesh-ent.com
Port:
587
Username:
[email protected]
Password:
M@hesh3981
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4492	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Bracket Drawing & Model_934711-0001.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2120 set thread context of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2120	Bracket Drawing & Model_934711-0001.exe
2120	Bracket Drawing & Model_934711-0001.exe
4492	powershell.exe
2120	Bracket Drawing & Model_934711-0001.exe
2120	Bracket Drawing & Model_934711-0001.exe
2120	Bracket Drawing & Model_934711-0001.exe
1328	MSBuild.exe
1328	MSBuild.exe
4492	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	Bracket Drawing & Model_934711-0001.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	1328	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1328	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4492	2120	Bracket Drawing & Model_934711-0001.exe	84
PID 2120 wrote to memory of 4492	2120	Bracket Drawing & Model_934711-0001.exe	84
PID 2120 wrote to memory of 4492	2120	Bracket Drawing & Model_934711-0001.exe	84
PID 2120 wrote to memory of 3628	2120	Bracket Drawing & Model_934711-0001.exe	86
PID 2120 wrote to memory of 3628	2120	Bracket Drawing & Model_934711-0001.exe	86
PID 2120 wrote to memory of 3628	2120	Bracket Drawing & Model_934711-0001.exe	86
PID 2120 wrote to memory of 3736	2120	Bracket Drawing & Model_934711-0001.exe	88
PID 2120 wrote to memory of 3736	2120	Bracket Drawing & Model_934711-0001.exe	88
PID 2120 wrote to memory of 3736	2120	Bracket Drawing & Model_934711-0001.exe	88
PID 2120 wrote to memory of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89
PID 2120 wrote to memory of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89
PID 2120 wrote to memory of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89
PID 2120 wrote to memory of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89
PID 2120 wrote to memory of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89
PID 2120 wrote to memory of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89
PID 2120 wrote to memory of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89
PID 2120 wrote to memory of 1328	2120	Bracket Drawing & Model_934711-0001.exe	89

C:\Users\Admin\AppData\Local\Temp\Bracket Drawing & Model_934711-0001.exe
"C:\Users\Admin\AppData\Local\Temp\Bracket Drawing & Model_934711-0001.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VktyLZ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VktyLZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp72BF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_te4a5asm.wpr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp72BF.tmp

Filesize
1KB

MD5
a0f924385bd1cb818dac01c3651b1652

SHA1
7caf0abe02a1b9694e79f70d5830163ca2d2749f

SHA256
a09a22e64fa62230740d453da3f658a1919f120915bd381b6b2bdc754ce8afe4

SHA512
3a1326fcb7350fc8c58a8189d9454ee51b50877435bbf9e37d6b3a793c3366f4c1914a35cc53a476ab336a5b2e3e1bad70daace2db395cee7ab0e4dad190e1d3

Download Submit
memory/1328-64-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/1328-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1328-33-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/1328-63-0x00000000068C0000-0x0000000006910000-memory.dmp

Filesize
320KB

Download
memory/2120-4-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Filesize
40KB

Download
memory/2120-7-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/2120-8-0x00000000062C0000-0x0000000006344000-memory.dmp

Filesize
528KB

Download
memory/2120-9-0x0000000009D80000-0x0000000009E1C000-memory.dmp

Filesize
624KB

Download
memory/2120-6-0x0000000005170000-0x000000000518A000-memory.dmp

Filesize
104KB

Download
memory/2120-5-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/2120-3-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Filesize
584KB

Download
memory/2120-2-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/2120-35-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/2120-0-0x00000000750BE000-0x00000000750BF000-memory.dmp

Filesize
4KB

Download
memory/2120-1-0x0000000000280000-0x0000000000346000-memory.dmp

Filesize
792KB

Download
memory/4492-34-0x0000000005AC0000-0x0000000005E14000-memory.dmp

Filesize
3.3MB

Download
memory/4492-50-0x00000000070C0000-0x0000000007163000-memory.dmp

Filesize
652KB

Download
memory/4492-21-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/4492-20-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/4492-18-0x0000000005010000-0x0000000005032000-memory.dmp

Filesize
136KB

Download
memory/4492-15-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/4492-36-0x00000000060D0000-0x00000000060EE000-memory.dmp

Filesize
120KB

Download
memory/4492-37-0x0000000006120000-0x000000000616C000-memory.dmp

Filesize
304KB

Download
memory/4492-38-0x00000000066A0000-0x00000000066D2000-memory.dmp

Filesize
200KB

Download
memory/4492-39-0x0000000071750000-0x000000007179C000-memory.dmp

Filesize
304KB

Download
memory/4492-49-0x00000000070A0000-0x00000000070BE000-memory.dmp

Filesize
120KB

Download
memory/4492-19-0x00000000051B0000-0x0000000005216000-memory.dmp

Filesize
408KB

Download
memory/4492-51-0x0000000007A40000-0x00000000080BA000-memory.dmp

Filesize
6.5MB

Download
memory/4492-52-0x0000000007400000-0x000000000741A000-memory.dmp

Filesize
104KB

Download
memory/4492-53-0x0000000007470000-0x000000000747A000-memory.dmp

Filesize
40KB

Download
memory/4492-54-0x0000000007680000-0x0000000007716000-memory.dmp

Filesize
600KB

Download
memory/4492-55-0x0000000007600000-0x0000000007611000-memory.dmp

Filesize
68KB

Download
memory/4492-56-0x0000000007630000-0x000000000763E000-memory.dmp

Filesize
56KB

Download
memory/4492-57-0x0000000007640000-0x0000000007654000-memory.dmp

Filesize
80KB

Download
memory/4492-58-0x0000000007740000-0x000000000775A000-memory.dmp

Filesize
104KB

Download
memory/4492-59-0x0000000007720000-0x0000000007728000-memory.dmp

Filesize
32KB

Download
memory/4492-62-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/4492-17-0x0000000005250000-0x0000000005878000-memory.dmp

Filesize
6.2MB

Download
memory/4492-14-0x00000000027C0000-0x00000000027F6000-memory.dmp

Filesize
216KB

Download