agenttesla | ec9b3edc6fdb39696ddff5fa0cba95f486c7fa765136eb92d78c94f57e37ccdd

Analysis

max time kernel
134s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOADING ADVICE.exe
Size 1.1MB
Sample240627-drbffssdpm
SHA256 ec9b3edc6fdb39696ddff5fa0cba95f486c7fa765136eb92d78c94f57e37ccdd
MD5 fea58a9c1285b131c944482fadf222e1
SHA1 9c8bcfb5b8e6caddd222ba132104803f30bc9f54
SHA512 c8c97d34bc08b665781d11630606cfde8b0459eccdfe54d08d7ed1eccc03416fb926eed940641915b94bb5c6c5aa572e168d7b4a01ba1c77db0af815d23e6666
SSDEEP 24576:MAHnh+eWsN3skA4RV1Hom2KXMmHafyZeMCqrWU65:rh+ZkldoPK8Yafy4MCD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.mahesh-ent.com
Port
587
Username
[email protected]
Password
M@hesh3981
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	name.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	api.ipify.org
22	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00070000000234f0-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4844 set thread context of 2916	4844	name.exe	95

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2916	RegSvcs.exe
2916	RegSvcs.exe
2916	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4844	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
696	LOADING ADVICE.exe
696	LOADING ADVICE.exe
4844	name.exe
4844	name.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
696	LOADING ADVICE.exe
696	LOADING ADVICE.exe
4844	name.exe
4844	name.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2916	RegSvcs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 4844	696	LOADING ADVICE.exe	94
PID 696 wrote to memory of 4844	696	LOADING ADVICE.exe	94
PID 696 wrote to memory of 4844	696	LOADING ADVICE.exe	94
PID 4844 wrote to memory of 2916	4844	name.exe	95
PID 4844 wrote to memory of 2916	4844	name.exe	95
PID 4844 wrote to memory of 2916	4844	name.exe	95
PID 4844 wrote to memory of 2916	4844	name.exe	95

C:\Users\Admin\AppData\Local\Temp\LOADING ADVICE.exe
"C:\Users\Admin\AppData\Local\Temp\LOADING ADVICE.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\LOADING ADVICE.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\LOADING ADVICE.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
1⤵
PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

unspawned

Path C:\Users\Admin\AppData\Local\Temp\unspawned
Size 28KB
SHA256 d1f588640192f5f7086a6338ae9eff3503586cf31727146de9028e00832dbc4b
MD5 6c06fce8d28315368b0c89f1e6bb2c54
SHA1 2342b289dd9d469494178e3854843395e46d332d
SHA512 b603f8e0f39157bf1409f8c69163ccb8aaf84858dcf518e6763e51176e5f1ea0b9721d4af2b53b0828f8ff99e80f16d28e3eb567c3ddf7a8fcb3ee60acd59955
SSDEEP 768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbp+IAyd4vfF3if6gyuq0:miTZ+2QoioGRk6ZklputwjpjBkCiw2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.1MB
SHA256 ec9b3edc6fdb39696ddff5fa0cba95f486c7fa765136eb92d78c94f57e37ccdd
MD5 fea58a9c1285b131c944482fadf222e1
SHA1 9c8bcfb5b8e6caddd222ba132104803f30bc9f54
SHA512 c8c97d34bc08b665781d11630606cfde8b0459eccdfe54d08d7ed1eccc03416fb926eed940641915b94bb5c6c5aa572e168d7b4a01ba1c77db0af815d23e6666
SSDEEP 24576:MAHnh+eWsN3skA4RV1Hom2KXMmHafyZeMCqrWU65:rh+ZkldoPK8Yafy4MCD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/696-10-0x00000000011F0000-0x00000000011F4000-memory.dmp

Download

memory/2916-30-0x0000000005B00000-0x00000000060A4000-memory.dmp

Download

memory/2916-29-0x000000007423E000-0x000000007423F000-memory.dmp

Download

memory/2916-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2916-31-0x00000000056F0000-0x0000000005756000-memory.dmp

Download

memory/2916-32-0x0000000074230000-0x00000000749E0000-memory.dmp

Download

memory/2916-33-0x0000000006C80000-0x0000000006CD0000-memory.dmp

Download

memory/2916-34-0x0000000006D70000-0x0000000006E02000-memory.dmp

Download

memory/2916-35-0x0000000006F00000-0x0000000006F0A000-memory.dmp

Download

memory/2916-36-0x000000007423E000-0x000000007423F000-memory.dmp

Download

memory/2916-37-0x0000000074230000-0x00000000749E0000-memory.dmp

Download