agenttesla | ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe
Size 1.0MB
Sample240617-bpmdtsxfkc
SHA256 ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0
MD5 e267d35c04ec7d2bb00678912cbfda4e
SHA1 4b373a815026143e941ff31b5e9a8c217e96986a
SHA512 45df9f3a01d920bd12d55c02e2e063a25afe1d8a0522bcb7e274b0a6ece3217aca5044c6e2aa31fd89a4f27b1880ceb32ea559bcdb8071e75672a70fb3f5800b
SSDEEP 24576:aAHnh+eWsN3skA4RV1Hom2KXMmHaHCvPksTO7di5:th+ZkldoPK8YaHgPRWS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.antoniomayol.com:21
Port
21
Username
[email protected]
Password
cMhKDQUk1{;%

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cacostomia.vbs	cacostomia.exe

Executes dropped EXE 1 IoCs

pid	Process
1376	cacostomia.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000c00000002337c-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1376 set thread context of 2020	1376	cacostomia.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2020	RegSvcs.exe
2020	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1376	cacostomia.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3140	ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe
3140	ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe
1376	cacostomia.exe
1376	cacostomia.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3140	ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe
3140	ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe
1376	cacostomia.exe
1376	cacostomia.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1376	3140	ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe	85
PID 3140 wrote to memory of 1376	3140	ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe	85
PID 3140 wrote to memory of 1376	3140	ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe	85
PID 1376 wrote to memory of 2020	1376	cacostomia.exe	86
PID 1376 wrote to memory of 2020	1376	cacostomia.exe	86
PID 1376 wrote to memory of 2020	1376	cacostomia.exe	86
PID 1376 wrote to memory of 2020	1376	cacostomia.exe	86

C:\Users\Admin\AppData\Local\Temp\ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe
"C:\Users\Admin\AppData\Local\Temp\ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\thixolabile\cacostomia.exe
  "C:\Users\Admin\AppData\Local\Temp\ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

starbright

Path C:\Users\Admin\AppData\Local\Temp\starbright
Size 29KB
SHA256 6c5406f4d5c0c45aeae6542005eabd284d421df9a840ab0a0a05dfca60a5cb08
MD5 95005f4ede34e61e99b794a45d3ba7d7
SHA1 cd1a90313e8ccd9dcd7aa3bde7e9f2a7eb77bdd0
SHA512 ad739921ba56679627f44fcaf855427d5eb5598b1a23068242be617354796ffc399d43a43bf3b8955e872c8fa715ab0e66250f53ad16eb5024119fbff32670bf
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbR+Ihd4vfF3if6gyNjiF:WiTZ+2QoioGRk6ZklputwjpjBkCiw2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

unbarricadoed

Path C:\Users\Admin\AppData\Local\Temp\unbarricadoed
Size 239KB
SHA256 fb5c8edf203db93e71dd250ed9fcfed6a4765d950b66ce8118583cab82e271fb
MD5 785908d01fc1dbdf379e6234e81386f0
SHA1 4d40ac524e6ac9ff27a9cbd58079f6e0b6f9216c
SHA512 4dc331551cf0901c3a97d57d968c9edd92cd2d6a37925fcd1f64dc1637214d8f530d83d0900c8ef297c2bd57216c11a36e0fe43a50142abf63c9a19cb71a7b82
SSDEEP 6144:3U+iL6a2CgUuZ59YhTFUFrYIBhWkn96OU66nGITz:E+iL6a2hUuZ59iTmhYiG6fg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cacostomia.exe

Path C:\Users\Admin\AppData\Local\thixolabile\cacostomia.exe
Size 1.0MB
SHA256 ed3d6abbf29cef04024bf460b686e66bb60564867402c273fe6bb5b066b0fac0
MD5 e267d35c04ec7d2bb00678912cbfda4e
SHA1 4b373a815026143e941ff31b5e9a8c217e96986a
SHA512 45df9f3a01d920bd12d55c02e2e063a25afe1d8a0522bcb7e274b0a6ece3217aca5044c6e2aa31fd89a4f27b1880ceb32ea559bcdb8071e75672a70fb3f5800b
SSDEEP 24576:aAHnh+eWsN3skA4RV1Hom2KXMmHaHCvPksTO7di5:th+ZkldoPK8YaHgPRWS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2020-30-0x0000000005910000-0x0000000005EB4000-memory.dmp

Download

memory/2020-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2020-29-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

Download

memory/2020-31-0x0000000005460000-0x00000000054C6000-memory.dmp

Download

memory/2020-32-0x0000000074E20000-0x00000000755D0000-memory.dmp

Download

memory/2020-33-0x00000000065B0000-0x0000000006600000-memory.dmp

Download

memory/2020-34-0x00000000066A0000-0x0000000006732000-memory.dmp

Download

memory/2020-35-0x0000000006640000-0x000000000664A000-memory.dmp

Download

memory/2020-36-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

Download

memory/2020-37-0x0000000074E20000-0x00000000755D0000-memory.dmp

Download

memory/3140-10-0x0000000000EA0000-0x0000000000EA4000-memory.dmp

Download