agenttesla | 4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe
Size

836KB
MD5

64d78850bcb1730279f0221558cfbf73
SHA1

c7aa58c22c4941eebc0663cedf20d3ec5d0373e4
SHA256

4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91
SHA512

54f998f313f80194be851781e8ad76017a0ecb374fc4e5af3b345baa6af913e7b2bc62bd1a9d18f9c842a6247eaebfd41c1b3066e771b6b2fd60539570da2b8e
SSDEEP

12288:eHnH0mNTkTaMg+i0hREhXV+/VSiyMIA22AxE/3v6OD7FP7r9r/+pppppppppppp9:eHxTkuMg+i00biEi/RcovBDZ1q

Score

10^/10

agenttesla credential_access discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
manlikeyou88
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2116	powershell.exe
1636	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe
2116	powershell.exe
1636	powershell.exe
2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe
2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe
2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe
2616	RegSvcs.exe
2616	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	2616	RegSvcs.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2116	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	31
PID 2672 wrote to memory of 2116	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	31
PID 2672 wrote to memory of 2116	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	31
PID 2672 wrote to memory of 2116	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	31
PID 2672 wrote to memory of 1636	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	33
PID 2672 wrote to memory of 1636	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	33
PID 2672 wrote to memory of 1636	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	33
PID 2672 wrote to memory of 1636	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	33
PID 2672 wrote to memory of 2892	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	35
PID 2672 wrote to memory of 2892	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	35
PID 2672 wrote to memory of 2892	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	35
PID 2672 wrote to memory of 2892	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	35
PID 2672 wrote to memory of 2624	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	37
PID 2672 wrote to memory of 2624	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	37
PID 2672 wrote to memory of 2624	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	37
PID 2672 wrote to memory of 2624	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	37
PID 2672 wrote to memory of 2624	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	37
PID 2672 wrote to memory of 2624	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	37
PID 2672 wrote to memory of 2624	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	37
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38
PID 2672 wrote to memory of 2616	2672	4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe	38

C:\Users\Admin\AppData\Local\Temp\4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe
"C:\Users\Admin\AppData\Local\Temp\4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4568453d8e6838ec1f2e1dd9cfe87b257aa7bcbebb888c3b3c8c0514afb74b91.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SLfjwrYOuWuupJ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SLfjwrYOuWuupJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD70D.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD70D.tmp

Filesize
1KB

MD5
24b63d0056a12464ede43af332c64914

SHA1
7368978ec13ebe73cd1a71738a41228325fe893f

SHA256
1b76386cc32d0fc11db37208a5a04669463da3f03ee6a6d97efc0ef01caa155a

SHA512
e3c5163076d4543ad464b54be8383dd85d4fda76fd1d88b9ca12ce3db0800f576a59c64e39b87bc22d8e3cec0b157e2318c70167656c3a811492327363e3e3e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
632dec26654823617d7e8299bae9a3a9

SHA1
bb40fddb4a821439d3d5c9d70276c05893d9c2fb

SHA256
1788430da808943251e9851ac8a8296383b2054bd18af914841e288490cb41e5

SHA512
b1ea66b5743ce7cc2b3f83b7d9cd8285ea0fc001e02016ea554b119b00de40d3d2b104a113a76997874b1a96c736f65c506a52f0e33627e0cc7689648f61ac6a

Download Submit
memory/2616-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2616-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2616-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2616-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2616-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2616-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2616-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2672-6-0x0000000005020000-0x00000000050A2000-memory.dmp

Filesize
520KB

Download
memory/2672-1-0x00000000012A0000-0x0000000001376000-memory.dmp

Filesize
856KB

Download
memory/2672-0-0x00000000748AE000-0x00000000748AF000-memory.dmp

Filesize
4KB

Download
memory/2672-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-3-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/2672-5-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-4-0x00000000748AE000-0x00000000748AF000-memory.dmp

Filesize
4KB

Download
memory/2672-32-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download