agenttesla | 544197acc02106823ce9681fdeeeeb816dfc4927a93c8a83d6c61f44b8933f48

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe
Size 1.1MB
Sample240615-dfznxa1ark
SHA256 627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943
MD5 d691c235d9b2c3bdb38aea8d0c278a4c
SHA1 24a4f27ed28f140a63c2cbef18f38d910c562ef2
SHA512 093f77e3cc1fc36f9cd4cd84914eef5704ae731aa8261e0f218a18ea858f3ff9adf2b29b398bdb68b3e2f09681621c04d77c7536254cad978cd84f74e8d519f7
SSDEEP 24576:uAHnh+eWsN3skA4RV1Hom2KXMmHa7UtYPLvesXhef0xy0FERJd5:Zh+ZkldoPK8Ya7UmPbesXSv3F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.antoniomayol.com:21
Port
21
Username
[email protected]
Password
cMhKDQUk1{;%

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\done.vbs	done.exe

Executes dropped EXE 1 IoCs

pid	Process
2372	done.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000d00000002338a-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 3268	2372	done.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3268	RegSvcs.exe
3268	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2372	done.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4916	627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe
4916	627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe
2372	done.exe
2372	done.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4916	627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe
4916	627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe
2372	done.exe
2372	done.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2372	4916	627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe	85
PID 4916 wrote to memory of 2372	4916	627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe	85
PID 4916 wrote to memory of 2372	4916	627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe	85
PID 2372 wrote to memory of 3268	2372	done.exe	86
PID 2372 wrote to memory of 3268	2372	done.exe	86
PID 2372 wrote to memory of 3268	2372	done.exe	86
PID 2372 wrote to memory of 3268	2372	done.exe	86

C:\Users\Admin\AppData\Local\Temp\627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe
"C:\Users\Admin\AppData\Local\Temp\627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\horrify\done.exe
  "C:\Users\Admin\AppData\Local\Temp\627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Milburt

Path C:\Users\Admin\AppData\Local\Temp\Milburt
Size 64KB
SHA256 a5209fbf83008289fa26564c8ad7c28d8eb2434b884a0769551a8d726d10d29d
MD5 051dc5c536d2d55d373678c8860d60b6
SHA1 4dcaf31b51d510b08f0b25db72c68b54b8ef92e6
SHA512 e6086a7ad3146a20ff8816d577d7aaa05853b4edb74968fea436004cb3ba6de55958baeb334b49d64ec8035a871cae5779252cae5da4544b558c846aa582d072
SSDEEP 1536:4l6O0OgJYAVG0q9+Ws+7rAvsIhCea+sEbOuYi:4lN0XiAVGnDfAvsInaHESi
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyogenesis

Path C:\Users\Admin\AppData\Local\Temp\pyogenesis
Size 28KB
SHA256 a2b692121545160d2e27304e9c7fbbe00d8f1a612d95065f502cb1c45466ea89
MD5 d9d197f5a8127873db3c4f083a154685
SHA1 4330623a09793b901cd460c4ed5db041180b91e5
SHA512 3f10fd40490d77bc4d0fd92c40ad5abe3b46d0d6a1ba5da75ae46559a013e194501b4951b5b73a571ce3d565998561574905d8066eb231a1898b524d76551efb
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbp+Icn84vfF3if6gy9xz:WiTZ+2QoioGRk6ZklputwjpjBkCiw2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

done.exe

Path C:\Users\Admin\AppData\Local\horrify\done.exe
Size 1.1MB
SHA256 627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943
MD5 d691c235d9b2c3bdb38aea8d0c278a4c
SHA1 24a4f27ed28f140a63c2cbef18f38d910c562ef2
SHA512 093f77e3cc1fc36f9cd4cd84914eef5704ae731aa8261e0f218a18ea858f3ff9adf2b29b398bdb68b3e2f09681621c04d77c7536254cad978cd84f74e8d519f7
SSDEEP 24576:uAHnh+eWsN3skA4RV1Hom2KXMmHa7UtYPLvesXhef0xy0FERJd5:Zh+ZkldoPK8Ya7UmPbesXSv3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3268-30-0x0000000005E40000-0x00000000063E4000-memory.dmp

Download

memory/3268-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3268-29-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

Download

memory/3268-31-0x0000000005890000-0x00000000058F6000-memory.dmp

Download

memory/3268-32-0x0000000074BA0000-0x0000000075350000-memory.dmp

Download

memory/3268-33-0x0000000006950000-0x00000000069A0000-memory.dmp

Download

memory/3268-34-0x0000000006AE0000-0x0000000006B72000-memory.dmp

Download

memory/3268-35-0x00000000069E0000-0x00000000069EA000-memory.dmp

Download

memory/3268-36-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

Download

memory/3268-37-0x0000000074BA0000-0x0000000075350000-memory.dmp

Download

memory/4916-10-0x0000000000580000-0x0000000000584000-memory.dmp

Download