agenttesla | ea5c40953d12e558456f1423e3bca11928623a562ed2efb5fd47ab3acf90e880

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
Size 1.0MB
Sample240617-bd5e9swhrf
SHA256 127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955
MD5 7d9e484d3a1ac6a6595ffb91b80496a4
SHA1 32424f5bb5a8b7a497e3f4ac31da0979e30a7088
SHA512 232599b4e4f06175d8e86dbcda183e7d40d9f121c782b4293389d1b994ce32ab94c969873b200436e8f09b4f17bda4b156a3ce1de2fbc4fae1ae3e47b8d5cb3e
SSDEEP 24576:Tkj2TMqpXIq/NFQ2qTqhuYTHVjmIx6cot0bftG:T+2nXIMQ2qW8YTHVHot0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.naveentour.com
Port
587
Username
[email protected]
Password
nav!T6u2@001
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2340	powershell.exe
2656	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
2440	RegSvcs.exe
2440	RegSvcs.exe
2656	powershell.exe
2340	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
Token: SeDebugPrivilege	2440	RegSvcs.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2340	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	28
PID 1052 wrote to memory of 2340	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	28
PID 1052 wrote to memory of 2340	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	28
PID 1052 wrote to memory of 2340	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	28
PID 1052 wrote to memory of 2656	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	30
PID 1052 wrote to memory of 2656	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	30
PID 1052 wrote to memory of 2656	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	30
PID 1052 wrote to memory of 2656	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	30
PID 1052 wrote to memory of 2544	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	32
PID 1052 wrote to memory of 2544	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	32
PID 1052 wrote to memory of 2544	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	32
PID 1052 wrote to memory of 2544	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	32
PID 1052 wrote to memory of 2608	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	34
PID 1052 wrote to memory of 2608	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	34
PID 1052 wrote to memory of 2608	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	34
PID 1052 wrote to memory of 2608	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	34
PID 1052 wrote to memory of 2608	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	34
PID 1052 wrote to memory of 2608	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	34
PID 1052 wrote to memory of 2608	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	34
PID 1052 wrote to memory of 2432	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	35
PID 1052 wrote to memory of 2432	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	35
PID 1052 wrote to memory of 2432	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	35
PID 1052 wrote to memory of 2432	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	35
PID 1052 wrote to memory of 2432	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	35
PID 1052 wrote to memory of 2432	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	35
PID 1052 wrote to memory of 2432	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	35
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36
PID 1052 wrote to memory of 2440	1052	127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe	36

C:\Users\Admin\AppData\Local\Temp\127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
"C:\Users\Admin\AppData\Local\Temp\127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SPrhntBmeSyq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SPrhntBmeSyq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA9E6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpA9E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA9E6.tmp
Size 1KB
SHA256 bf088ecd46e55e326cad8a8c76adbcadace391bfafdc697292e77abde1e4704e
MD5 a146955e429890594a0bcc05288e89eb
SHA1 dfe4418998bd70712a89530fb00de6b06d104fad
SHA512 185708eba5bb84adb7980ca2dd7a9101b854ddf633ca971d2971f5de795d7928ffc12aa645a418d31a8944b34948e2805e1152b472dcaf66d91d5ac1c864aa25
MD5 SHA1 SHA512

Submit Download

972DO2FUT5QBX68W025V.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\972DO2FUT5QBX68W025V.temp
Size 7KB
SHA256 59f50bddf9b5fe702aaf143783f7d4dc7949a7210aba97202d4d2cfc907902e8
MD5 5ee7cbc4fc893c6535b2ddbf4e73e848
SHA1 f7bd6dc06edd8fb0c71b3eb9e7ab4cb96eccae70
SHA512 ed25dd6ab7b7d1f3b58f0433a05f5a265a65d5d5b2fca0756b87fed77606c0629a26370c01c91252c8e2150625b40717129c744b236805ffff24ef052a24ee34
SSDEEP 96:wleCpM8VnqvsqvJCwohleCpM8VnqvsEHyqvJCworYGMVQHcz79YXlUVE:UvJUoDvJAHnorYTBz79Yz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1052-31-0x0000000074BC0000-0x00000000752AE000-memory.dmp

Download

memory/1052-1-0x0000000001270000-0x0000000001378000-memory.dmp

Download

memory/1052-2-0x0000000074BC0000-0x00000000752AE000-memory.dmp

Download

memory/1052-3-0x00000000004E0000-0x00000000004FA000-memory.dmp

Download

memory/1052-4-0x0000000000540000-0x0000000000550000-memory.dmp

Download

memory/1052-5-0x0000000005780000-0x000000000582A000-memory.dmp

Download

memory/1052-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Download

memory/2440-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2440-30-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2440-27-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2440-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2440-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2440-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2440-20-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2440-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download