agenttesla | 3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c

Analysis

max time kernel
106s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
Size 761KB
Sample240615-b69kpavdqa
SHA256 3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c
MD5 354af2f032d753d4841be2f087c1479f
SHA1 0dd9c2866e5098c214a12fdc3ac4998cbf167b99
SHA512 5a8b1fd1e05ebe768cc0fa56f4b38fd1b60d26337c6fc3caf5059e983bcb08ea3fb0fb307dceab9420de6c32febccd9d0009cb115900b5e350856ec225a88c09
SSDEEP 12288:J1I6SaGRIuDJpW2YwPUqw2yK1WHV8GyRFO05vZE0Oh6O:1Ep6yRFtsR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://liceultehnologicrosiajiu.ro
Port
21
Username
[email protected]
Password
6974450000Pe

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hPKmV = "C:\\Users\\Admin\\AppData\\Roaming\\hPKmV\\hPKmV.exe"	InstallUtil.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3144 set thread context of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
1884	InstallUtil.exe
1884	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
Token: SeDebugPrivilege	1884	InstallUtil.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 2192	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	91
PID 3144 wrote to memory of 2192	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	91
PID 3144 wrote to memory of 2192	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	91
PID 3144 wrote to memory of 2192	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	91
PID 3144 wrote to memory of 2192	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	91
PID 3144 wrote to memory of 2192	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	91
PID 3144 wrote to memory of 2192	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	91
PID 3144 wrote to memory of 2192	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	91
PID 3144 wrote to memory of 3656	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	93
PID 3144 wrote to memory of 3656	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	93
PID 3144 wrote to memory of 3656	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	93
PID 3144 wrote to memory of 3656	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	93
PID 3144 wrote to memory of 3656	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	93
PID 3144 wrote to memory of 3656	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	93
PID 3144 wrote to memory of 3656	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	93
PID 3144 wrote to memory of 3656	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	93
PID 3144 wrote to memory of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94
PID 3144 wrote to memory of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94
PID 3144 wrote to memory of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94
PID 3144 wrote to memory of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94
PID 3144 wrote to memory of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94
PID 3144 wrote to memory of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94
PID 3144 wrote to memory of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94
PID 3144 wrote to memory of 1884	3144	3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe	94

C:\Users\Admin\AppData\Local\Temp\3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe
"C:\Users\Admin\AppData\Local\Temp\3afe48389479229ee833d9f813f1c839fc71ad6c4e04291076499dd3585a7a4c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-12-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1884-20-0x0000000074A90000-0x0000000075240000-memory.dmp

Download

memory/1884-19-0x0000000006AD0000-0x0000000006B20000-memory.dmp

Download

memory/1884-17-0x0000000074A90000-0x0000000075240000-memory.dmp

Download

memory/1884-16-0x0000000005950000-0x00000000059B6000-memory.dmp

Download

memory/1884-15-0x0000000074A90000-0x0000000075240000-memory.dmp

Download

memory/3144-4-0x00000000056F0000-0x0000000005782000-memory.dmp

Download

memory/3144-7-0x00000000068D0000-0x00000000068DA000-memory.dmp

Download

memory/3144-8-0x0000000074A90000-0x0000000075240000-memory.dmp

Download

memory/3144-9-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

Download

memory/3144-10-0x0000000007C80000-0x0000000007C9A000-memory.dmp

Download

memory/3144-11-0x000000000A2F0000-0x000000000A2F6000-memory.dmp

Download

memory/3144-6-0x0000000006770000-0x00000000067B4000-memory.dmp

Download

memory/3144-14-0x0000000074A90000-0x0000000075240000-memory.dmp

Download

memory/3144-5-0x0000000074A90000-0x0000000075240000-memory.dmp

Download

memory/3144-0-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

Download

memory/3144-3-0x0000000005C00000-0x00000000061A4000-memory.dmp

Download

memory/3144-2-0x0000000005570000-0x000000000560C000-memory.dmp

Download

memory/3144-1-0x00000000004E0000-0x00000000005A4000-memory.dmp

Download