agenttesla | f7cdea5cbabbed3fe3e137d50076ba977d6cc21490b350784bb4628a9914da40

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-HO3RFQ2024.exe
Size 758KB
Sample240809-k5brpsyfnj
SHA256 f7cdea5cbabbed3fe3e137d50076ba977d6cc21490b350784bb4628a9914da40
MD5 5c3b6f17a9984815ccff591a17c5e309
SHA1 20e9c3a013434563aac04430c49f0bb9c3ddf26d
SHA512 ce1c1f4aeba8e132d3fdfcd27e8db3900b2fe38efda7a880b15d3e6ef1561c2e98ce8c0b7bd392f3205a2d707fc1f047b539585b6eef13e2b9d03eada52c16b4
SSDEEP 12288:lWrDZRmYOcf9qNzpeeSeGdW2hYdUcXkQ6d+rlzrzjlOD6eNkxaiRZ:lWW0YNNe3VFVQDRzHoW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection credential_access discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.grupomorales.mx
Port
587
Username
[email protected]
Password
!%J8}*dhpT{{
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2440	powershell.exe
2900	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO-HO3RFQ2024.exe
Key opened	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO-HO3RFQ2024.exe
Key opened	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO-HO3RFQ2024.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 3012	2732	PO-HO3RFQ2024.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO-HO3RFQ2024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO-HO3RFQ2024.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2732	PO-HO3RFQ2024.exe
2732	PO-HO3RFQ2024.exe
2732	PO-HO3RFQ2024.exe
2732	PO-HO3RFQ2024.exe
2440	powershell.exe
2900	powershell.exe
3012	PO-HO3RFQ2024.exe
3012	PO-HO3RFQ2024.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	PO-HO3RFQ2024.exe
Token: SeDebugPrivilege	3012	PO-HO3RFQ2024.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2440	2732	PO-HO3RFQ2024.exe	30
PID 2732 wrote to memory of 2440	2732	PO-HO3RFQ2024.exe	30
PID 2732 wrote to memory of 2440	2732	PO-HO3RFQ2024.exe	30
PID 2732 wrote to memory of 2440	2732	PO-HO3RFQ2024.exe	30
PID 2732 wrote to memory of 2900	2732	PO-HO3RFQ2024.exe	32
PID 2732 wrote to memory of 2900	2732	PO-HO3RFQ2024.exe	32
PID 2732 wrote to memory of 2900	2732	PO-HO3RFQ2024.exe	32
PID 2732 wrote to memory of 2900	2732	PO-HO3RFQ2024.exe	32
PID 2732 wrote to memory of 2832	2732	PO-HO3RFQ2024.exe	34
PID 2732 wrote to memory of 2832	2732	PO-HO3RFQ2024.exe	34
PID 2732 wrote to memory of 2832	2732	PO-HO3RFQ2024.exe	34
PID 2732 wrote to memory of 2832	2732	PO-HO3RFQ2024.exe	34
PID 2732 wrote to memory of 2852	2732	PO-HO3RFQ2024.exe	36
PID 2732 wrote to memory of 2852	2732	PO-HO3RFQ2024.exe	36
PID 2732 wrote to memory of 2852	2732	PO-HO3RFQ2024.exe	36
PID 2732 wrote to memory of 2852	2732	PO-HO3RFQ2024.exe	36
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37
PID 2732 wrote to memory of 3012	2732	PO-HO3RFQ2024.exe	37

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO-HO3RFQ2024.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO-HO3RFQ2024.exe

C:\Users\Admin\AppData\Local\Temp\PO-HO3RFQ2024.exe
"C:\Users\Admin\AppData\Local\Temp\PO-HO3RFQ2024.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-HO3RFQ2024.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PNcZQkqfP.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PNcZQkqfP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8102.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\PO-HO3RFQ2024.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-HO3RFQ2024.exe"
  2⤵
  PID:2852
- C:\Users\Admin\AppData\Local\Temp\PO-HO3RFQ2024.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-HO3RFQ2024.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp8102.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8102.tmp
Size 1KB
SHA256 a899ed00c692fbfbcf8f65a240cba10a2748e7309da818306523ce3bef2d11f6
MD5 879397a1ef6c2c65b052da32fa867bfb
SHA1 c1b2bd4a7e04a24d525473967b4f720ee806bbc4
SHA512 4e5c8aecddb2722b6391a1d482cee3510c5e027199bf678c8f4479739225c8bb2e8b8e58782caf87ae3e9ee1a12b7827de676bddbf3b4ac6ac5e109c33dd43e7
MD5 SHA1 SHA512

Submit Download

EXW2T1FJWE8F7TL662F9.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EXW2T1FJWE8F7TL662F9.temp
Size 7KB
SHA256 fe0419014d2f18970691da0fbde9a0b575b6f22fe9aa77b38b532d75066e7b4b
MD5 5b1d8fd33c7b7269be689025f6d5c7ff
SHA1 31aeada1feb0fecb535ed4043f48f7e210ad311b
SHA512 5b1044abf0931448c48176fb82208a80ac01d1b439cdbaa65c93bb3ef087b83309946ff287a7244afd5e713ece5057e7f0dd317cf0d1b05ec4e70b14f6b42574
SSDEEP 96:kx6CFM80nqvsqvJCwoivx6CFM80nqvsEHyqvJCwor0TlrZ1QHXyu7slsXlUVgE:0fwUoWfwAHnorylHLu7slsy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2732-4-0x0000000074E40000-0x000000007552E000-memory.dmp

Download

memory/2732-3-0x0000000000530000-0x000000000054A000-memory.dmp

Download

memory/2732-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Download

memory/2732-5-0x0000000000650000-0x000000000065E000-memory.dmp

Download

memory/2732-6-0x0000000000660000-0x0000000000676000-memory.dmp

Download

memory/2732-7-0x0000000001060000-0x00000000010D2000-memory.dmp

Download

memory/2732-2-0x0000000000AF0000-0x0000000000B7E000-memory.dmp

Download

memory/2732-1-0x00000000010F0000-0x00000000011B4000-memory.dmp

Download

memory/2732-33-0x0000000074E40000-0x000000007552E000-memory.dmp

Download

memory/3012-30-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3012-29-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3012-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/3012-26-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3012-24-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3012-22-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3012-20-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3012-32-0x0000000000400000-0x0000000000430000-memory.dmp

Download