agenttesla | c037429f30412b9308880840a0a5ee836ddd685e1af97c67853fed62308516c7

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bypassed.exe
Size 90KB
Sample240903-rtlabsyhnm
SHA256 049ea73a545bf2c262f03a53e2c54020dbf3314b694d37d0d0255768c73cbcf1
MD5 5d046cd83e8e4bbb64ca82a250e90ea8
SHA1 231c777db2aaa5677953a275137e8959ecc447ff
SHA512 6c6f5ab99735353b65eed9efd7b3f5cd90f5879cdc67856384be9aa22022377404632bea26b7c26ae771f07515251a67c360da7d3d76e76091a729d2d4bfeb87
SSDEEP 1536:j7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfNw3ON:/7DhdC6kzWypvaQ0FxyNTBfNr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral3/memory/2060-6-0x00000000056C0000-0x00000000058D4000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypassed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Morphine.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Morphine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Morphine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Morphine.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2060	Morphine.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	Morphine.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2952	1952	bypassed.exe	31
PID 1952 wrote to memory of 2952	1952	bypassed.exe	31
PID 1952 wrote to memory of 2952	1952	bypassed.exe	31
PID 1952 wrote to memory of 2952	1952	bypassed.exe	31
PID 2952 wrote to memory of 2460	2952	cmd.exe	32
PID 2952 wrote to memory of 2460	2952	cmd.exe	32
PID 2952 wrote to memory of 2460	2952	cmd.exe	32
PID 2952 wrote to memory of 2180	2952	cmd.exe	33
PID 2952 wrote to memory of 2180	2952	cmd.exe	33
PID 2952 wrote to memory of 2180	2952	cmd.exe	33
PID 2952 wrote to memory of 2060	2952	cmd.exe	34
PID 2952 wrote to memory of 2060	2952	cmd.exe	34
PID 2952 wrote to memory of 2060	2952	cmd.exe	34
PID 2952 wrote to memory of 2060	2952	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\bypassed.exe
"C:\Users\Admin\AppData\Local\Temp\bypassed.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B9AE.tmp\B9AF.tmp\B9B0.bat C:\Users\Admin\AppData\Local\Temp\bypassed.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\openfiles.exe
    openfiles
    3⤵
    PID:2460
- - C:\Windows\system32\certutil.exe
    certutil -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\certificate.crt"
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Morphine.exe
    "C:\Users\Admin\AppData\Local\Temp\Morphine.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B9B0.bat

Path C:\Users\Admin\AppData\Local\Temp\B9AE.tmp\B9AF.tmp\B9B0.bat
Size 1KB
SHA256 3c5bee69f5de7ccf115c18fe5d908a8a8f6232178f5af7bbb74a8efeddf85647
MD5 4139d82b7887de939696e636b8c4a86e
SHA1 42ac906cc609814eb6cc27d5d0ff93c25ff842f2
SHA512 8ddb01874b1c1e37780dfe4defaae393d65e8102ba9f4d0ff67c88694aea5167402b2c748e18078c15924583418bae6fa10a627868f2c94528519bd803103ceb
MD5 SHA1 SHA512

Submit Download

memory/2060-3-0x0000000073E0E000-0x0000000073E0F000-memory.dmp

Download

memory/2060-4-0x00000000012A0000-0x0000000001872000-memory.dmp

Download

memory/2060-5-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/2060-6-0x00000000056C0000-0x00000000058D4000-memory.dmp

Download

memory/2060-7-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/2060-8-0x0000000073E0E000-0x0000000073E0F000-memory.dmp

Download

memory/2060-9-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads