agenttesla | bd0e1cfd8ac5fef73e78b0a784c11682ed8d3120e6293d7d87425e5cd65d91eb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rShippingDocuments.exe
Size 875KB
Sample240821-nvkhmswfmc
SHA256 bd0e1cfd8ac5fef73e78b0a784c11682ed8d3120e6293d7d87425e5cd65d91eb
MD5 dc9e6b694b51bed0f18efdb98dfb6574
SHA1 178c356d906ed81d6492b215e2f5b849976dbb80
SHA512 389f84f3f1e5e7436c677dd3d3d1d9e90d173930bada7be3affc060b20500f099f808f9eb3b00446c43ca178d9c8ea4c98cf7198fa2933ef64928ab119eab2b9
SSDEEP 24576:sMaJ7C/qaSulKnSGPZxWstParxPXmgmJnx+kZRa:giUuXOERmgaBra
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla credential_access discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.starmech.net
Port
587
Username
[email protected]
Password
nics123
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2692	powershell.exe
2728	powershell.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\BjTxJte = "C:\\Users\\Admin\\AppData\\Roaming\\BjTxJte\\BjTxJte.exe"	rShippingDocuments.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 2628	2368	rShippingDocuments.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rShippingDocuments.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rShippingDocuments.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2368	rShippingDocuments.exe
2628	rShippingDocuments.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2368	rShippingDocuments.exe
2628	rShippingDocuments.exe
2628	rShippingDocuments.exe
2692	powershell.exe
2728	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	rShippingDocuments.exe
Token: SeDebugPrivilege	2628	rShippingDocuments.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	rShippingDocuments.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2692	2368	rShippingDocuments.exe	31
PID 2368 wrote to memory of 2692	2368	rShippingDocuments.exe	31
PID 2368 wrote to memory of 2692	2368	rShippingDocuments.exe	31
PID 2368 wrote to memory of 2692	2368	rShippingDocuments.exe	31
PID 2368 wrote to memory of 2728	2368	rShippingDocuments.exe	33
PID 2368 wrote to memory of 2728	2368	rShippingDocuments.exe	33
PID 2368 wrote to memory of 2728	2368	rShippingDocuments.exe	33
PID 2368 wrote to memory of 2728	2368	rShippingDocuments.exe	33
PID 2368 wrote to memory of 2748	2368	rShippingDocuments.exe	34
PID 2368 wrote to memory of 2748	2368	rShippingDocuments.exe	34
PID 2368 wrote to memory of 2748	2368	rShippingDocuments.exe	34
PID 2368 wrote to memory of 2748	2368	rShippingDocuments.exe	34
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37
PID 2368 wrote to memory of 2628	2368	rShippingDocuments.exe	37

C:\Users\Admin\AppData\Local\Temp\rShippingDocuments.exe
"C:\Users\Admin\AppData\Local\Temp\rShippingDocuments.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\rShippingDocuments.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XZpJWBSpVC.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XZpJWBSpVC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC2A.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\rShippingDocuments.exe
  "C:\Users\Admin\AppData\Local\Temp\rShippingDocuments.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpFC2A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpFC2A.tmp
Size 1KB
SHA256 c79c4d137e909fbdf159290d1a8cbc519411da0bdd11a8a0e2924532f49fb56d
MD5 4794d888bf5692c7cc828cb276a7bbe0
SHA1 e120bd274ccc4fd5cc06d27f7db6b5a77de7fae3
SHA512 aebaaed2477d2e27a559e14f7cff9c59cd5dfada56ff69f11eac679c0d5881f59c1609f084023c9ec4c44c84d0dff00e90cdaf44114b8841d684b792b072d953
MD5 SHA1 SHA512

Submit Download

6CSAY2BD7PJ9326ZBCKG.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6CSAY2BD7PJ9326ZBCKG.temp
Size 7KB
SHA256 77c1da2e6b455f827e577a66caa5b6a2f34d19b12a55aee8a05507f64e3c8b68
MD5 aa3b48173c71eebf4ebc04373c61b2e2
SHA1 9e95446573619f84d249a2d34f4ef5746d0eb9e6
SHA512 2f367ae8b7b82c7ada81731685a032ff68a4f01fa6c55182325b2efd7c61a0561a5f5aa95a10d7196de9696507552c37142311752a952e1c6b48cb99ecee3f9c
SSDEEP 96:kx6CFM8snqvsqvJCwoivx6CFM8snqvsEHyqvJCwor0TlTZpQHXyu7sl0XlUVgE:0fQUoWfQAHnorylnLu7sl0y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2368-4-0x0000000074A50000-0x000000007513E000-memory.dmp

Download

memory/2368-32-0x0000000074A50000-0x000000007513E000-memory.dmp

Download

memory/2368-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmp

Download

memory/2368-5-0x0000000000520000-0x0000000000530000-memory.dmp

Download

memory/2368-6-0x00000000050D0000-0x0000000005154000-memory.dmp

Download

memory/2368-2-0x0000000074A50000-0x000000007513E000-memory.dmp

Download

memory/2368-1-0x0000000000260000-0x0000000000340000-memory.dmp

Download

memory/2368-3-0x0000000000510000-0x0000000000522000-memory.dmp

Download

memory/2628-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2628-28-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2628-29-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2628-19-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2628-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2628-31-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2628-25-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2628-21-0x0000000000400000-0x0000000000442000-memory.dmp

Download