agenttesla | a6dd827620007d29efb0f45a61ef6d7e1e6957d56103e8c61d6562cda8ef9c78

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order SMG 201906 20190816orderGMD#0498366Deta.exe
Size 2.3MB
Sample240723-gdfd2azfjf
SHA256 a6dd827620007d29efb0f45a61ef6d7e1e6957d56103e8c61d6562cda8ef9c78
MD5 179e1628adcd4f90b64d8e8e7e63214a
SHA1 4636dac57ced7ebfdce05311cb48f16ea2059eae
SHA512 5eb7ac5fd8fd81c621457318b42b29e04e69c6f330fc8acc39ac65b39d0d4e6f698b16abd95fdf05da3ea04931b7c8f67ff07abcfb904bab023d5d581f14b23d
SSDEEP 49152:uB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R8VDYWg1Hpb67eQPVZD5bO:OaRrFCI2S7eg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla redline foz discovery infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
s82.gocheapweb.com
Port
587
Username
[email protected]
Password
london@1759
Email to
[email protected]

Extracted

Family

redline

Botnet

206.217.128.11:1912

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000186f7-18.dat	family_redline
behavioral1/memory/2640-24-0x00000000000E0000-0x0000000000132000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
2628	neworigin.exe
2640	build.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	installutil.exe
2232	installutil.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Order SMG 201906 20190816orderGMD#0498366Deta = "C:\\Users\\Admin\\Order SMG 201906 20190816orderGMD#0498366Deta.exe"	Order SMG 201906 20190816orderGMD#0498366Deta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2752 set thread context of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2628	neworigin.exe
2628	neworigin.exe
2640	build.exe
2640	build.exe
2640	build.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	neworigin.exe
Token: SeDebugPrivilege	2640	build.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	neworigin.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2752 wrote to memory of 2232	2752	Order SMG 201906 20190816orderGMD#0498366Deta.exe	31
PID 2232 wrote to memory of 2628	2232	installutil.exe	32
PID 2232 wrote to memory of 2628	2232	installutil.exe	32
PID 2232 wrote to memory of 2628	2232	installutil.exe	32
PID 2232 wrote to memory of 2628	2232	installutil.exe	32
PID 2232 wrote to memory of 2640	2232	installutil.exe	33
PID 2232 wrote to memory of 2640	2232	installutil.exe	33
PID 2232 wrote to memory of 2640	2232	installutil.exe	33
PID 2232 wrote to memory of 2640	2232	installutil.exe	33

C:\Users\Admin\AppData\Local\Temp\Order SMG 201906 20190816orderGMD#0498366Deta.exe
"C:\Users\Admin\AppData\Local\Temp\Order SMG 201906 20190816orderGMD#0498366Deta.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Users\Admin\AppData\Local\Temp\neworigin.exe
    "C:\Users\Admin\AppData\Local\Temp\neworigin.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

build.exe

Path \Users\Admin\AppData\Local\Temp\build.exe
Size 300KB
SHA256 9c7afebf61dac442001870fc5e2db48483a45588a1f56cd88db520be2541f94e
MD5 88a687e7448034a46789918fb765fcd9
SHA1 825883ce8787ecaa970ff31534e88f0201ec1b58
SHA512 b63db4517c8492e5cbbbcfe74bc7be6625ae14e6556549d1bafeb0ca9465a6bff8e7eca2b665d95e4de00bdd46af4c1a042c7cfe650300ca9f16b07ccec34ba5
SSDEEP 3072:acZqf7D34Tp/0+mA0kywMlQEg85fB1fA0PuTVAtkxz43RMeqiOL2bBOA:acZqf7DItnGCQNB1fA0GTV8ka0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

neworigin.exe

Path \Users\Admin\AppData\Local\Temp\neworigin.exe
Size 244KB
SHA256 dc441006cb45c2cfac6c521f6cd4c16860615d21081563bd9e368de6f7e8ab6b
MD5 d6a4cf0966d24c1ea836ba9a899751e5
SHA1 392d68c000137b8039155df6bb331d643909e7e7
SHA512 9fa7aa65b4a0414596d8fd3e7d75a09740a5a6c3db8262f00cb66cd4c8b43d17658c42179422ae0127913deb854db7ed02621d0eeb8ddff1fac221a8e0d1ca35
SSDEEP 3072:K5rmOKmqOPQrF5Z6YzyV29z556CWZxtm:KBmOKmqOPQrF/6YP9zZWjt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2232-1-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/2232-5-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/2232-3-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/2232-6-0x00000000748FE000-0x00000000748FF000-memory.dmp

Download

memory/2232-8-0x00000000748F0000-0x0000000074FDE000-memory.dmp

Download

memory/2232-23-0x00000000748F0000-0x0000000074FDE000-memory.dmp

Download

memory/2628-15-0x00000000011D0000-0x0000000001214000-memory.dmp

Download

memory/2640-24-0x00000000000E0000-0x0000000000132000-memory.dmp

Download