agenttesla | 409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe
Size

998KB
MD5

7641b5e9a95918508f0acecc8739efc4
SHA1

f6a6a343af6aaa323c8eb3d578a709d0c30a9819
SHA256

409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21
SHA512

9092420d8de2fa38bebea8566652bb004b80390a0c638f705f1e15275d4651b521f9f3c2a9c1ef4b80991509cc5782dfd160bde79e1d2ad767895ba13aa0872c
SSDEEP

24576:XAjH3DIlB5pwpW5EMg+F9/BG0d2ZtDeUmaXYC9XDoCqbl:wP4ipmg+F9/Bl27dYgXcl

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.estampar.com.br
Port:
587
Username:
[email protected]
Password:
fHd@4AxQSHIS
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

resource	yara_rule
behavioral1/memory/2504-30-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2504-29-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2504-28-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2504-25-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2504-23-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

resource	yara_rule
behavioral1/memory/2504-30-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2504-29-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2504-28-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2504-25-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2504-23-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 5 IoCs

resource	yara_rule
behavioral1/memory/2504-30-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2504-29-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2504-28-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2504-25-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2504-23-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

resource	yara_rule
behavioral1/memory/2504-30-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2504-29-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2504-28-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2504-25-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2504-23-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2504-30-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2504-29-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2504-28-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2504-25-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2504-23-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2504-30-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2504-29-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2504-28-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2504-25-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2504-23-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2504-30-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2504-29-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2504-28-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2504-25-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2504-23-0x0000000000400000-0x0000000000476000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2652	powershell.exe
2552	powershell.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\OIjBUmm = "C:\\Users\\Admin\\AppData\\Roaming\\OIjBUmm\\OIjBUmm.exe"	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 756 set thread context of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2504	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe
2504	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe
2652	powershell.exe
2552	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2652	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	28
PID 756 wrote to memory of 2652	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	28
PID 756 wrote to memory of 2652	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	28
PID 756 wrote to memory of 2652	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	28
PID 756 wrote to memory of 2552	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	30
PID 756 wrote to memory of 2552	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	30
PID 756 wrote to memory of 2552	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	30
PID 756 wrote to memory of 2552	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	30
PID 756 wrote to memory of 2872	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	32
PID 756 wrote to memory of 2872	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	32
PID 756 wrote to memory of 2872	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	32
PID 756 wrote to memory of 2872	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	32
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34
PID 756 wrote to memory of 2504	756	409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe	34

C:\Users\Admin\AppData\Local\Temp\409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe
"C:\Users\Admin\AppData\Local\Temp\409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iHEckBaX.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iHEckBaX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7291.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe
  "C:\Users\Admin\AppData\Local\Temp\409b216bb2d2747140b1a05b5cbc9fc8ff21bd1dbe6635a67d1d71a69a92da21.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7291.tmp

Filesize
1KB

MD5
c4b2ffd49afc271063093c47dba93dfa

SHA1
c2d494b7a6a0db11367171d9113587acb9767539

SHA256
566c14d8577a3c239364cdad4b7dd6a072106b5d86f91b034258459d176b15a2

SHA512
474774126239642980b78e4f65ec838c8ad4cedf2e78c05333c8bccb0caa7b19f2e1bd47916abc141e60dd669a82eaf32c8647b27144df369acf8fdf6d303acf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\94LJAZLS2429N17VBM5H.temp

Filesize
7KB

MD5
012b06f306fbace7ba5933b6adfd9cb0

SHA1
e14a4fe9106d192fbb706125f0d59078dc1b5f1a

SHA256
bd8d1b45004f6dffd736069dfd791c47b0d5209bcd1b0d5788f5805ca79c27b9

SHA512
d7e6a99ebc8156c8f09e0b72ccd9b40dd58d71b08b94d5078e594fb8b5c934fd655af0038fca2a3b0f38a419d4463c92fb3294d3de1abbbef18f71688a1d5e50

Download Submit
memory/756-4-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/756-31-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/756-0-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/756-5-0x0000000005D40000-0x0000000005DF8000-memory.dmp

Filesize
736KB

Download
memory/756-6-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/756-2-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/756-1-0x0000000000880000-0x000000000097C000-memory.dmp

Filesize
1008KB

Download
memory/756-3-0x0000000000700000-0x000000000071A000-memory.dmp

Filesize
104KB

Download
memory/2504-19-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2504-29-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2504-28-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2504-25-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2504-23-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2504-21-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2504-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2504-30-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download