agenttesla | f5da5b71aaee25c3769bfdbbd086208d0ff97ff923ad7903f813d3a81460013f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ for WIKA pdf.exe
Size 1.1MB
Sample240624-halx3ssflp
SHA256 f5da5b71aaee25c3769bfdbbd086208d0ff97ff923ad7903f813d3a81460013f
MD5 4afeff5e460036561645b1061beadf4c
SHA1 8cd24e389b32b6f7a45b551ef9529fcbd6463cc3
SHA512 d234c50144da100fe205530d9792c2775fc54ba77c567949dc4af396ad4b901af9057665a118cb2289cf3a024372622bb41bed81160b3188b7b915d217e60889
SSDEEP 24576:dAHnh+eWsN3skA4RV1Hom2KXMmHaf7Ojjg2ydU5:8h+ZkldoPK8Yaf7Ojsk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.jubileegenerationsltd.co.ke
Port
587
Username
[email protected]
Password
Chelseamel@22

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.jubileegenerationsltd.co.ke
Port
587
Username
[email protected]
Password
Chelseamel@22
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdjkhje.vbs	gdjkhje.exe

Executes dropped EXE 1 IoCs

pid	Process
3384	gdjkhje.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hmSHaw = "C:\\Users\\Admin\\AppData\\Roaming\\hmSHaw\\hmSHaw.exe"	RegSvcs.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	api.ipify.org
28	api.ipify.org
29	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002342f-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3384 set thread context of 3892	3384	gdjkhje.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3892	RegSvcs.exe
3892	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3384	gdjkhje.exe
3384	gdjkhje.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3508	RFQ for WIKA pdf.exe
3508	RFQ for WIKA pdf.exe
3384	gdjkhje.exe
3384	gdjkhje.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3508	RFQ for WIKA pdf.exe
3508	RFQ for WIKA pdf.exe
3384	gdjkhje.exe
3384	gdjkhje.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3892	RegSvcs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3384	3508	RFQ for WIKA pdf.exe	87
PID 3508 wrote to memory of 3384	3508	RFQ for WIKA pdf.exe	87
PID 3508 wrote to memory of 3384	3508	RFQ for WIKA pdf.exe	87
PID 3384 wrote to memory of 3892	3384	gdjkhje.exe	88
PID 3384 wrote to memory of 3892	3384	gdjkhje.exe	88
PID 3384 wrote to memory of 3892	3384	gdjkhje.exe	88
PID 3384 wrote to memory of 3892	3384	gdjkhje.exe	88

C:\Users\Admin\AppData\Local\Temp\RFQ for WIKA pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ for WIKA pdf.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\directory\gdjkhje.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ for WIKA pdf.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ for WIKA pdf.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jailless

Path C:\Users\Admin\AppData\Local\Temp\jailless
Size 29KB
SHA256 9b66a89a953f98748908a9804c308bd78daa9a1830967268bff81ece2a82b8ae
MD5 f0e840c137266fb6cffc214d8d6ddcd5
SHA1 977a431afb8c7801a79973dd650a85e43351aea4
SHA512 42c82ce50d79822397a518abe3dd8a431a1998a52cc751050543d0f2cbeec4dc378255b8d4746bde455fc87d5dbdacf1854b8f52964565bf81f2fe99e60e42cc
SSDEEP 768:AiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbD+ICc54vfF3if6gyyNI:AiTZ+2QoioGRk6ZklputwjpjBkCiw2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

proximobuccal

Path C:\Users\Admin\AppData\Local\Temp\proximobuccal
Size 248KB
SHA256 5f71584e207a7b1f797c8ca073e334185a848de7f6567753ce9f7038469356da
MD5 df037cd2d32764fecb22cef7c8b8bfca
SHA1 a4f25e602816d785fb577674166803bd14164b24
SHA512 057f974e4ce740dcec39232f78b7b359db58dc3ca818d6501434147108ab9f9d6c82f96020206e729e740c8b9114021c7cda71590b042e91998ac06f9d826953
SSDEEP 6144:Z9j5n/zKXrSXqKwUr3Ik+53+2bZsT3eL1:Z9N7KbSXWdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gdjkhje.exe

Path C:\Users\Admin\AppData\Local\directory\gdjkhje.exe
Size 1.1MB
SHA256 f5da5b71aaee25c3769bfdbbd086208d0ff97ff923ad7903f813d3a81460013f
MD5 4afeff5e460036561645b1061beadf4c
SHA1 8cd24e389b32b6f7a45b551ef9529fcbd6463cc3
SHA512 d234c50144da100fe205530d9792c2775fc54ba77c567949dc4af396ad4b901af9057665a118cb2289cf3a024372622bb41bed81160b3188b7b915d217e60889
SSDEEP 24576:dAHnh+eWsN3skA4RV1Hom2KXMmHaf7Ojjg2ydU5:8h+ZkldoPK8Yaf7Ojsk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3508-10-0x0000000002780000-0x0000000002784000-memory.dmp

Download

memory/3892-30-0x0000000005300000-0x00000000058A4000-memory.dmp

Download

memory/3892-29-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Download

memory/3892-28-0x00000000003B0000-0x00000000003F4000-memory.dmp

Download

memory/3892-31-0x0000000004EC0000-0x0000000004F26000-memory.dmp

Download

memory/3892-32-0x0000000074C10000-0x00000000753C0000-memory.dmp

Download

memory/3892-35-0x00000000062F0000-0x0000000006340000-memory.dmp

Download

memory/3892-36-0x00000000063E0000-0x000000000647C000-memory.dmp

Download

memory/3892-37-0x0000000006480000-0x0000000006512000-memory.dmp

Download

memory/3892-38-0x00000000063A0000-0x00000000063AA000-memory.dmp

Download

memory/3892-39-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Download

memory/3892-40-0x0000000074C10000-0x00000000753C0000-memory.dmp

Download