agenttesla | 2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe
Size

1.1MB
MD5

ffb088c4c220cbadd1f3f72296221be9
SHA1

bf4f7b96eb46eaf37bf267828b0c60e35d2faa07
SHA256

2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f
SHA512

27e50ea45f48260db56c6df40af3e6965e97d64f446c0fe39ab60bd46550e31b11dc0ad4aad5296a98d7f6622217cc387819dc835f02504f9721b8eba43adcfe
SSDEEP

24576:pAHnh+eWsN3skA4RV1Hom2KXcmtcRHLRIqAUBt8Va8HGm:wh+ZkldoPKsacRrOqA7A8

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.ozkahil.com
Port:
587
Username:
[email protected]
Password:
1122334455

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
2348	name.exe

Loads dropped DLL 1 IoCs

pid	Process
2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000014667-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2588	2348	name.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2588	RegSvcs.exe
2588	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2348	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2588	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe
2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe
2348	name.exe
2348	name.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe
2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe
2348	name.exe
2348	name.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2348	2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe	28
PID 2184 wrote to memory of 2348	2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe	28
PID 2184 wrote to memory of 2348	2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe	28
PID 2184 wrote to memory of 2348	2184	2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe	28
PID 2348 wrote to memory of 2588	2348	name.exe	29
PID 2348 wrote to memory of 2588	2348	name.exe	29
PID 2348 wrote to memory of 2588	2348	name.exe	29
PID 2348 wrote to memory of 2588	2348	name.exe	29
PID 2348 wrote to memory of 2588	2348	name.exe	29
PID 2348 wrote to memory of 2588	2348	name.exe	29
PID 2348 wrote to memory of 2588	2348	name.exe	29
PID 2348 wrote to memory of 2588	2348	name.exe	29

C:\Users\Admin\AppData\Local\Temp\2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe
"C:\Users\Admin\AppData\Local\Temp\2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Countee

Filesize
265KB

MD5
78b377597bd2d003cdb3cbe8167fe2a2

SHA1
e2df19c6f8300fcb60b7a1818afe8a4f8e6fc506

SHA256
e02e914e8833df25b5cb081d64b297a945b692fd11ab1bd0db36a3dcd3f9e148

SHA512
cf1e41d07167476a4693f48a5c11f52565d766f02e4360ad3b7c8da0b6e0d88209fa844258675433ab549c240e27fda11c09a643fd0b29cbb2da59931472462a

Download Submit
C:\Users\Admin\AppData\Local\Temp\croc

Filesize
28KB

MD5
c35d9a9df57cc23cda5ca14f161567cb

SHA1
52e593c7be6ab75cbf8bf487fdaff5507df87d77

SHA256
f16ba8b42828b24fcca3898c0e9b0ef655d1d473171ec77cf5b9dc0d1670d282

SHA512
dd1b4f4ee5ed88c44be36959c10c8d067f9ff4b2a4ec5c0d836ef371f38975aa3ca1f316a03a1566c8930128faeb038ee027193918e55941ea97c304a081ad74

Download Submit
\Users\Admin\AppData\Local\directory\name.exe

Filesize
1.1MB

MD5
ffb088c4c220cbadd1f3f72296221be9

SHA1
bf4f7b96eb46eaf37bf267828b0c60e35d2faa07

SHA256
2360548efd0e104cbc31982ecc2b3203763272c2e92109c20f9632dac7eebe2f

SHA512
27e50ea45f48260db56c6df40af3e6965e97d64f446c0fe39ab60bd46550e31b11dc0ad4aad5296a98d7f6622217cc387819dc835f02504f9721b8eba43adcfe

Download Submit
memory/2184-11-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download
memory/2588-63-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-34-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2588-35-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2588-36-0x000000007438E000-0x000000007438F000-memory.dmp

Filesize
4KB

Download
memory/2588-37-0x0000000000300000-0x0000000000356000-memory.dmp

Filesize
344KB

Download
memory/2588-38-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-41-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-40-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-39-0x0000000001D80000-0x0000000001DD4000-memory.dmp

Filesize
336KB

Download
memory/2588-53-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-73-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-42-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-87-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-43-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-99-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-45-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-47-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-49-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-51-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-59-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-71-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-32-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2588-67-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-97-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-101-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-95-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-93-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-91-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-89-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-85-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-83-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-81-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-79-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-77-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-75-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-69-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-65-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-61-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-57-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-55-0x0000000001D80000-0x0000000001DCF000-memory.dmp

Filesize
316KB

Download
memory/2588-1140-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-1155-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2588-1156-0x000000007438E000-0x000000007438F000-memory.dmp

Filesize
4KB

Download
memory/2588-1157-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download