agenttesla | af448bd9c6a6315bfa00b0301e57545cffe8ed75d30fbd18fdbd4cec606283b7

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af448bd9c6a6315bfa00b0301e57545cffe8ed75d30fbd18fdbd4cec606283b7.js
Size

30KB
MD5

86185d6d160eabe88692b9dbf3ff3e71
SHA1

66cf746399849a72487a7ce9f8dd652d982a72bd
SHA256

af448bd9c6a6315bfa00b0301e57545cffe8ed75d30fbd18fdbd4cec606283b7
SHA512

15da27ecca298442aded5ad4a5a45522880013e7f9906d386167b27ad9439d08ecafdfd6c3de638bc3719d46d89f45116cf560772db11d3aae420cfbf059bd3e
SSDEEP

768:OVWm9aFqK2YmaQ4Vg4vf4bQuvAsBvPquk6Q:Omkk6Q

Score

10^/10

agenttesla credential_access discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
162.254.34.31
Port:
587
Username:
[email protected]
Password:
M992uew1mw6Z
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	224	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	WScript.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	api.ipify.org
54	api.ipify.org

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 1912	3592	powershell.exe	102

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	wscript.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	1	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3888	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3592	powershell.exe
3592	powershell.exe
2352	powershell.exe
2352	powershell.exe
3592	powershell.exe
1912	MSBuild.exe
1912	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	1912	MSBuild.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 224	232	wscript.exe	82
PID 232 wrote to memory of 224	232	wscript.exe	82
PID 4556 wrote to memory of 3592	4556	WScript.exe	93
PID 4556 wrote to memory of 3592	4556	WScript.exe	93
PID 4556 wrote to memory of 2352	4556	WScript.exe	100
PID 4556 wrote to memory of 2352	4556	WScript.exe	100
PID 3592 wrote to memory of 1912	3592	powershell.exe	102
PID 3592 wrote to memory of 1912	3592	powershell.exe	102
PID 3592 wrote to memory of 1912	3592	powershell.exe	102
PID 3592 wrote to memory of 1912	3592	powershell.exe	102
PID 3592 wrote to memory of 1912	3592	powershell.exe	102
PID 3592 wrote to memory of 1912	3592	powershell.exe	102
PID 3592 wrote to memory of 1912	3592	powershell.exe	102
PID 3592 wrote to memory of 1912	3592	powershell.exe	102
PID 2352 wrote to memory of 4776	2352	powershell.exe	103
PID 2352 wrote to memory of 4776	2352	powershell.exe	103
PID 3592 wrote to memory of 5036	3592	powershell.exe	104
PID 3592 wrote to memory of 5036	3592	powershell.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\af448bd9c6a6315bfa00b0301e57545cffe8ed75d30fbd18fdbd4cec606283b7.js
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\restored.vbe"
  2⤵
  - Blocklisted process makes network request
  PID:224

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\lwRdEznrBuqLMiX.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3592" "2764" "2700" "2768" "0" "0" "2772" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:5036
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2352" "2684" "2612" "2688" "0" "0" "2692" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4776

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\StepDebug.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\restored.vbe

Filesize
14KB

MD5
a51620220423d15df9de991aa0b10742

SHA1
5c571d6a3e025ee9ab6eff03c7064ecc37fff450

SHA256
ff2ab43a5ebbea267159e3cfce4ecdf829d050d92ffdcb34097afc12699d6501

SHA512
1d392a7f9ca92a42819b891a01fdcd4d19b3f93ddc025efa20d421b65bcfaf8452d01f0f25994befd35ec61b9e4c27ddadb8c7b07866dcc7cbcfc1ee766df5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
9461a7cfb20ff5381df28f51b80c5ef1

SHA1
c86c53fca1dcbe307dafbefbb366abf52c9f5eca

SHA256
d4af1948337d0deb725f4f2b1fe1a9b60f4519841e28748b11bfd62ccd71e028

SHA512
da1e17f67dfebb004ba93d489be504fd7af6d62709ada2581ffa77880baecdaa0015b49d36333d18216d9dc6aad7b0ea2e5bd224d8d3f65ee9b66a05fc45e304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
2b30242fe3de4d9edb43c28f08031166

SHA1
3dec76d6059bc908c3c1afe3c6512bb9b2884466

SHA256
176626b849aae53dfff8e6577e14ce326ef446cb4ef95fc7aade9b6e2444345a

SHA512
9891c05741744099c40dd66f951e963fe762e3d241a43f338bc805df81727fc0728c0f257a229f7c5a79d713832cd933488eb6740cb17e29630a53b4753b4240

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uijm0p3v.xim.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
388B

MD5
3e9f1759bcc47af4d05057d108e446fe

SHA1
a2dadd614165a6f7b0f244aace320d5f190ac4b3

SHA256
5b88f7c0d633b892e2af47af82fd66c2f50da70b8db43b43a3ce13a5ff03188e

SHA512
a04e8ea72c9c96db26b334b1ee832dd31d7931771302700f5c797a866ca0b7e8be702efa4727ae02e50d262cfddf0a0af8ded9719c6cd46221ca696ee54f6cb7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
926c236d7acb37fc3ee7585ab3a0a63a

SHA1
59b9adaa180d74c23f28f89d5559a4277563d1da

SHA256
b0155038105fd780799564fa372f3dba1902a5708806c44176fa7c7a657aec5e

SHA512
43abacc1c1a19facd56fa800f42334cc91cc5edde7ce7fdd846e20d843bcf88c8936d3da7e4542ab1c20eda371879b40457709c5ff6958a21ad58b769c64eed9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
293ea2c59d7acfa684ecd5703dbe694c

SHA1
44a9d7d210465963dbcef6d7227ae25870dc01f8

SHA256
bd1ae53e26cf64cf144b14f8734116b76a606f1b82b6b4476ef922900de6dad9

SHA512
12c6359e5e751aecca20af0f32dd2cd9eb100d90a3f03f25d4657aa8b6dfbdf4ff9773917560401ab6ce77cc90e4b519d3b7829ef3fd7bd8b4a35e0ccb2a024e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
c8e56c13073b4c3b7a6c1af23b7ad65e

SHA1
87f3ab88ee1e9475af72d38bc8843bd84b422862

SHA256
ecefb112af2eca250d2df3a455fead880f765913241efddd1439c259f4a41015

SHA512
4f33b3069425b0c81bd984b4826e1dfecd83e9a8505b6cc8719685d2635b5f483ba980230b6c429a2199d3043753afc9237e2f54295e698426d1989dc20f12b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
b1b44ccecb14b9a729bbb498e8756041

SHA1
da4f3278f69812c4534f892b276f1cd706a4f345

SHA256
dc4f36e0a18f9647774050c2175236b1b46eda3375eb1c189f7e911f0900f0aa

SHA512
bb253c0b52a5f32ab18773d53c553ec8c1a32439a6c06883fd458800e8912df5c1fc1bd068f3740b9b1debe485083537320e225651b2c7bd9f1b4a016e1b4072

Download Submit
C:\Users\Admin\AppData\Roaming\lwRdEznrBuqLMiX.vbs

Filesize
2KB

MD5
2f1ec696b66433614ccd5ab314649206

SHA1
dace4eeba067b5446d5b149d7b0c3cfd7abb0359

SHA256
3d64a72c07ea79fbeaefc7ec6e12b755d9ce55815e60cb872ca8d94a47e977e7

SHA512
fe3b70a5e31b77221fa0ab6501909a07260c912735d93991c4812c5b70806b78ac689a6628b4b045b83db6870dcab1a6e0cdb57dc5bf514c9e2a3608873d9ff7

Download Submit
memory/1912-80-0x0000000000950000-0x0000000000990000-memory.dmp

Filesize
256KB

Download
memory/1912-99-0x00000000057C0000-0x0000000005D64000-memory.dmp

Filesize
5.6MB

Download
memory/1912-103-0x0000000006870000-0x000000000687A000-memory.dmp

Filesize
40KB

Download
memory/1912-102-0x00000000068F0000-0x0000000006982000-memory.dmp

Filesize
584KB

Download
memory/1912-101-0x0000000006800000-0x0000000006850000-memory.dmp

Filesize
320KB

Download
memory/1912-100-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/3592-79-0x000001A0989B0000-0x000001A0989BA000-memory.dmp

Filesize
40KB

Download
memory/3592-78-0x000001A0989A0000-0x000001A0989AA000-memory.dmp

Filesize
40KB

Download
memory/3592-18-0x000001A100080000-0x000001A1000F6000-memory.dmp

Filesize
472KB

Download
memory/3592-17-0x000001A0FFF50000-0x000001A0FFF94000-memory.dmp

Filesize
272KB

Download
memory/3592-7-0x000001A0FFF20000-0x000001A0FFF42000-memory.dmp

Filesize
136KB

Download
memory/3888-19-0x00007FFEEED70000-0x00007FFEEED80000-memory.dmp

Filesize
64KB

Download
memory/3888-25-0x00007FFEEC410000-0x00007FFEEC420000-memory.dmp

Filesize
64KB

Download
memory/3888-21-0x00007FFEEED70000-0x00007FFEEED80000-memory.dmp

Filesize
64KB

Download
memory/3888-20-0x00007FFEEED70000-0x00007FFEEED80000-memory.dmp

Filesize
64KB

Download
memory/3888-23-0x00007FFEEED70000-0x00007FFEEED80000-memory.dmp

Filesize
64KB

Download
memory/3888-22-0x00007FFEEED70000-0x00007FFEEED80000-memory.dmp

Filesize
64KB

Download
memory/3888-24-0x00007FFEEC410000-0x00007FFEEC420000-memory.dmp

Filesize
64KB

Download