agenttesla | e985bf115705eac5a7189ff3f06aa848c10fac371489d0e5e67f3a4cd959be8b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remittance INV HSBC ref 072324678.exe
Size 1.2MB
Sample240723-hd5jlashpj
SHA256 e985bf115705eac5a7189ff3f06aa848c10fac371489d0e5e67f3a4cd959be8b
MD5 dfbb62852cd419a67ae0fef645fb0890
SHA1 07bc116a44e6871337414dbcb1940be708f8d22a
SHA512 aa8cf835a0824941d470cbe50c8beba8803c1ae9abc7820e63ba7bc47968e3e99d6cf5270aae60ed34a1d26f2ad0f635506bd5bc1b6b3e108bacc9e2e98f17e8
SSDEEP 24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aGPsFuSyvQX:ZTvC/MTQYxsWR7ahFuSN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.eatrepeatindia.com
Port
587
Username
[email protected]
Password
QQYIO12fxBmdO
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\tyTwe = "C:\\Users\\Admin\\AppData\\Roaming\\tyTwe\\tyTwe.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 3016	2884	Remittance INV HSBC ref 072324678.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2884	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3016	RegSvcs.exe
3016	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2884	Remittance INV HSBC ref 072324678.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3016	2884	Remittance INV HSBC ref 072324678.exe	30
PID 2884 wrote to memory of 3016	2884	Remittance INV HSBC ref 072324678.exe	30
PID 2884 wrote to memory of 3016	2884	Remittance INV HSBC ref 072324678.exe	30
PID 2884 wrote to memory of 3016	2884	Remittance INV HSBC ref 072324678.exe	30
PID 2884 wrote to memory of 3016	2884	Remittance INV HSBC ref 072324678.exe	30
PID 2884 wrote to memory of 3016	2884	Remittance INV HSBC ref 072324678.exe	30
PID 2884 wrote to memory of 3016	2884	Remittance INV HSBC ref 072324678.exe	30
PID 2884 wrote to memory of 3016	2884	Remittance INV HSBC ref 072324678.exe	30
PID 2884 wrote to memory of 2016	2884	Remittance INV HSBC ref 072324678.exe	31
PID 2884 wrote to memory of 2016	2884	Remittance INV HSBC ref 072324678.exe	31
PID 2884 wrote to memory of 2016	2884	Remittance INV HSBC ref 072324678.exe	31
PID 2884 wrote to memory of 2016	2884	Remittance INV HSBC ref 072324678.exe	31

C:\Users\Admin\AppData\Local\Temp\Remittance INV HSBC ref 072324678.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance INV HSBC ref 072324678.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Remittance INV HSBC ref 072324678.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 300
  2⤵
  - Program crash
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-10-0x0000000000150000-0x0000000000154000-memory.dmp

Download

memory/3016-11-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-13-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-15-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3016-16-0x00000000748EE000-0x00000000748EF000-memory.dmp

Download

memory/3016-17-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Download

memory/3016-20-0x00000000748EE000-0x00000000748EF000-memory.dmp

Download

memory/3016-21-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Download