agenttesla | 22ccf479b4d573336a84d6b9ad20b598426250cda675f27d97fe0a89dc4e1bb9

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EUROPROFILI Invoice ref 06132467.exe
Size 1.1MB
Sample240614-brag2stbrr
SHA256 52e9c6c032ebccc5a65f97c45b83dfb4aac589082d78d94b43207b5326fd2db2
MD5 05548b20d357b107acbc6d0a2a645bf6
SHA1 4a98da8d963233caf2e26fca3a5d234c2feadf8b
SHA512 abec0b3cd2232dd847c386a7e0becf4a2ff93aef1f87a19cb9a19ca22b1c4e9ccc2bdc6c941336831d62a0c177a4b90f377779811bd47b558242ae779bd35a05
SSDEEP 24576:OAHnh+eWsN3skA4RV1Hom2KXMmHanF4b6aCf39JQ2I5:5h+ZkldoPK8YanFCboe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.sklada.bg
Port
587
Username
[email protected]
Password
Kaloyan10
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
2180	name.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Running = "C:\\Users\\Admin\\AppData\\Roaming\\Running\\Running.exe"	RegSvcs.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	api.ipify.org
38	ip-api.com
36	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023270-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 572	2180	name.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
572	RegSvcs.exe
572	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2180	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	572	RegSvcs.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4544	EUROPROFILI Invoice ref 06132467.exe
4544	EUROPROFILI Invoice ref 06132467.exe
4544	EUROPROFILI Invoice ref 06132467.exe
2180	name.exe
2180	name.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4544	EUROPROFILI Invoice ref 06132467.exe
4544	EUROPROFILI Invoice ref 06132467.exe
4544	EUROPROFILI Invoice ref 06132467.exe
2180	name.exe
2180	name.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2180	4544	EUROPROFILI Invoice ref 06132467.exe	91
PID 4544 wrote to memory of 2180	4544	EUROPROFILI Invoice ref 06132467.exe	91
PID 4544 wrote to memory of 2180	4544	EUROPROFILI Invoice ref 06132467.exe	91
PID 2180 wrote to memory of 572	2180	name.exe	92
PID 2180 wrote to memory of 572	2180	name.exe	92
PID 2180 wrote to memory of 572	2180	name.exe	92
PID 2180 wrote to memory of 572	2180	name.exe	92

C:\Users\Admin\AppData\Local\Temp\EUROPROFILI Invoice ref 06132467.exe
"C:\Users\Admin\AppData\Local\Temp\EUROPROFILI Invoice ref 06132467.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\EUROPROFILI Invoice ref 06132467.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\EUROPROFILI Invoice ref 06132467.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

exhilaratingly

Path C:\Users\Admin\AppData\Local\Temp\exhilaratingly
Size 241KB
SHA256 9368a374551c8ccc5c9365e3b2add5f7bd88ed00c91d92ff7eaf06ac442d55b1
MD5 ad2a0543c45e5df58555ac19a41750a0
SHA1 8196d140a06fe6a262bace3fcdd39cc91cd9520e
SHA512 6545d706067be7a6a5673c3a0b25e1b9b4a0528094894e854dddaa3903be01ff8742333e00dee932b0f1e7f4fdd4f201966f56016cdd2de85b0bd5dfeef53f17
SSDEEP 6144:/DKQxyV5I2le2mKCg6oJH1AglZsKVRGFxnXJqYI:/DTxv2DmK6oJOgf1WXrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

thixophobia

Path C:\Users\Admin\AppData\Local\Temp\thixophobia
Size 28KB
SHA256 4db8b2f6b87b66c7b56a16adcffe942b6666e948df4ef1c04fd6a85b4ce174f9
MD5 2d29e9a52bfd70cd2fa697e3be230ee9
SHA1 8aa336f377100a01df9601c46cbe78bc779ee16f
SHA512 9d36749b1c02a45aa19f905ba83c0d421030a7cdde3f8c3e3e47c79cd83c3c2b95b932fbde5de1153db0ecf743d622e7cbdff425145952c73113064731a4e6ad
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNba+Iitb4vfF3if6gygkZ:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RO
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.1MB
SHA256 52e9c6c032ebccc5a65f97c45b83dfb4aac589082d78d94b43207b5326fd2db2
MD5 05548b20d357b107acbc6d0a2a645bf6
SHA1 4a98da8d963233caf2e26fca3a5d234c2feadf8b
SHA512 abec0b3cd2232dd847c386a7e0becf4a2ff93aef1f87a19cb9a19ca22b1c4e9ccc2bdc6c941336831d62a0c177a4b90f377779811bd47b558242ae779bd35a05
SSDEEP 24576:OAHnh+eWsN3skA4RV1Hom2KXMmHanF4b6aCf39JQ2I5:5h+ZkldoPK8YanFCboe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/572-30-0x00000000054E0000-0x0000000005A84000-memory.dmp

Download

memory/572-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/572-29-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Download

memory/572-31-0x0000000074F40000-0x00000000756F0000-memory.dmp

Download

memory/572-32-0x0000000004EB0000-0x0000000004F16000-memory.dmp

Download

memory/572-35-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Download

memory/572-36-0x0000000006440000-0x0000000006490000-memory.dmp

Download

memory/572-37-0x0000000006530000-0x00000000065C2000-memory.dmp

Download

memory/572-38-0x00000000064C0000-0x00000000064CA000-memory.dmp

Download

memory/572-39-0x0000000074F40000-0x00000000756F0000-memory.dmp

Download

memory/4544-10-0x00000000021B0000-0x00000000021B4000-memory.dmp

Download