agenttesla | 69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe
Size 1.1MB
Sample240619-cr4asssbqa
SHA256 69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88
MD5 95705aaf7b8950554498a5432aaed92e
SHA1 fa1a0ed6872a420478f7349a2e0b5c4947f42de3
SHA512 c0481207d510067b55cb177ded53004385a414a1d0744123cdc2db58f4d94f78500dce52d60e5155095552b105eea80f72c7e1d0e669b164639e05ef49dad798
SSDEEP 24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8ag3CVJV8H:HTvC/MTQYxsWR7aoCHV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.jaszredony.hu
Port
587
Username
[email protected]
Password
jRedony77
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
1176	name.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newfile = "C:\\Users\\Admin\\AppData\\Roaming\\newfile\\newfile.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0009000000023354-14.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 2084	1176	name.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	RegSvcs.exe
2084	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1176	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
872	69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe
872	69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe
1176	name.exe
1176	name.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
872	69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe
872	69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe
1176	name.exe
1176	name.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1176	872	69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe	86
PID 872 wrote to memory of 1176	872	69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe	86
PID 872 wrote to memory of 1176	872	69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe	86
PID 1176 wrote to memory of 2084	1176	name.exe	87
PID 1176 wrote to memory of 2084	1176	name.exe	87
PID 1176 wrote to memory of 2084	1176	name.exe	87
PID 1176 wrote to memory of 2084	1176	name.exe	87

C:\Users\Admin\AppData\Local\Temp\69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe
"C:\Users\Admin\AppData\Local\Temp\69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:872
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

furcation

Path C:\Users\Admin\AppData\Local\Temp\furcation
Size 239KB
SHA256 5a1e0e47f05d3ca3e01f0e82efd8b036d430a91444c4c17c15e05a5777e46bca
MD5 4970912e7dd53e2f483b4e0102d7ad3d
SHA1 6634ae4d8290056d47a7fd782ac9d36b55641dae
SHA512 97970dae898a6febcabbad34e43d86109cde20580962c977050f2e84486a8e238b8383f790964225422a337b7d6b538f3c39a7417ec4f3f76ff4638dd7f51478
SSDEEP 6144:kL2KcGTJrNZzTlBXpK4CjIXlrOzeYrxXYW7NPmJOTN:k6L2HZXvpK4FrQeYruM5mcN
MD5 SHA1 SHA512 SSDEEP

Submit Download

roundups

Path C:\Users\Admin\AppData\Local\Temp\roundups
Size 28KB
SHA256 6f46decf18841ad62988b2622256d1573680245241ead33a075d4d3851094b50
MD5 0e059a3f589e42d8b650c46f3f6d1f84
SHA1 277237b682830f7176a1ad71fcea3bf434132ab5
SHA512 a6f0edc32fe5f57bac4b99df34173a3a215de51c8ce84fbbe838b106d0f376f5c41d6bba2b9ac9b01a66efa7ddce0dd7d93f9f27b88132d5b5c62bab0eb510a1
SSDEEP 384:yJejrqv2+JeeZ//PlWrqG8/QKJmJEc4PNlLzTHN0V0MT5YLGRHhC:seCuEeeJ/PlWrRJEc4PNRHpO5awC
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.1MB
SHA256 69b4e8302250ad1073b8071d9ef6a5878c31ac22d9bde49195b1c60dd10eed88
MD5 95705aaf7b8950554498a5432aaed92e
SHA1 fa1a0ed6872a420478f7349a2e0b5c4947f42de3
SHA512 c0481207d510067b55cb177ded53004385a414a1d0744123cdc2db58f4d94f78500dce52d60e5155095552b105eea80f72c7e1d0e669b164639e05ef49dad798
SSDEEP 24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8ag3CVJV8H:HTvC/MTQYxsWR7aoCHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/872-10-0x00000000014A0000-0x00000000014A4000-memory.dmp

Download

memory/2084-30-0x0000000005830000-0x0000000005DD4000-memory.dmp

Download

memory/2084-29-0x000000007543E000-0x000000007543F000-memory.dmp

Download

memory/2084-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2084-31-0x0000000005280000-0x00000000052E6000-memory.dmp

Download

memory/2084-32-0x0000000075430000-0x0000000075BE0000-memory.dmp

Download

memory/2084-34-0x0000000006560000-0x00000000065B0000-memory.dmp

Download

memory/2084-35-0x0000000006650000-0x00000000066E2000-memory.dmp

Download

memory/2084-36-0x00000000065E0000-0x00000000065EA000-memory.dmp

Download

memory/2084-37-0x000000007543E000-0x000000007543F000-memory.dmp

Download

memory/2084-38-0x0000000075430000-0x0000000075BE0000-memory.dmp

Download