agenttesla | 5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe
Size

1.3MB
MD5

44458945e94a220f25a7c9be7a00431e
SHA1

c8bf329b998fccc2af3c7c1abb7226d666ce2401
SHA256

5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276
SHA512

ff729f50f129d013f8eb4fcddafc3d7eae23c879a8d828420e98fa1daa81ef2d9b82e7ace3f065d230d7b22e6a8d3199da6c716af58166e4f8e805f332bf3242
SSDEEP

24576:RAHnh+eWsN3skA4RV1Hom2KXMmHaIGQq3t9JT90/jgmsBsrYm5:oh+ZkldoPK8Yaoq3dB0MlsrZ

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.ppg-pa.com
Port:
587
Username:
[email protected]
Password:
DKKfy2001$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\antholite.vbs	antholite.exe

Executes dropped EXE 1 IoCs

pid	Process
4692	antholite.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org
16	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023448-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4692 set thread context of 1312	4692	antholite.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antholite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1312	RegSvcs.exe
1312	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4692	antholite.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3284	5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe
3284	5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe
4692	antholite.exe
4692	antholite.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3284	5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe
3284	5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe
4692	antholite.exe
4692	antholite.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1312	RegSvcs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4692	3284	5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe	83
PID 3284 wrote to memory of 4692	3284	5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe	83
PID 3284 wrote to memory of 4692	3284	5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe	83
PID 4692 wrote to memory of 1312	4692	antholite.exe	84
PID 4692 wrote to memory of 1312	4692	antholite.exe	84
PID 4692 wrote to memory of 1312	4692	antholite.exe	84
PID 4692 wrote to memory of 1312	4692	antholite.exe	84

C:\Users\Admin\AppData\Local\Temp\5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe
"C:\Users\Admin\AppData\Local\Temp\5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\troopwise\antholite.exe
  "C:\Users\Admin\AppData\Local\Temp\5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\buncal

Filesize
265KB

MD5
d70af62a772bee904f870f3bcca3123a

SHA1
9a59b1d6c6a2c46635e96061338c8281ca6b53f0

SHA256
fbfc5c8bd769aa52c684e72a4824c06c2adad81c50f561020fc9e06ad016ee57

SHA512
350f9c05593f3d6b71a031fdc3159cc37f9c816b6f9a65cc929bc4ba1d4afe6ec96327ca9286e13ac55b1771293b9d92d4e3f98686bee7fef835b261f934db1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\subpredication

Filesize
57KB

MD5
c527a5127adcfab40a3f4b6ff40ccb9d

SHA1
344ddbf8c59aeaa0945ad131a4b4e06e4f464901

SHA256
567d0a2f6877f18f9ee16638d04a041a3e0c15e0cc47f613c86aa906874a8113

SHA512
4a8960bcdf1fa1b20b009e6a48bebdbfe2804b20a5fa5a40b4fda53cf6b255e3bc1e000a3d76b14e09e6139bf9c66e970a427e79e8b0a77999b4215928441a0d

Download Submit
C:\Users\Admin\AppData\Local\troopwise\antholite.exe

Filesize
1.3MB

MD5
44458945e94a220f25a7c9be7a00431e

SHA1
c8bf329b998fccc2af3c7c1abb7226d666ce2401

SHA256
5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276

SHA512
ff729f50f129d013f8eb4fcddafc3d7eae23c879a8d828420e98fa1daa81ef2d9b82e7ace3f065d230d7b22e6a8d3199da6c716af58166e4f8e805f332bf3242

Download Submit
memory/1312-28-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1312-29-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1312-30-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1312-31-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1312-32-0x00000000741DE000-0x00000000741DF000-memory.dmp

Filesize
4KB

Download
memory/1312-33-0x00000000050B0000-0x0000000005106000-memory.dmp

Filesize
344KB

Download
memory/1312-34-0x00000000741D0000-0x0000000074980000-memory.dmp

Filesize
7.7MB

Download
memory/1312-36-0x0000000005140000-0x0000000005194000-memory.dmp

Filesize
336KB

Download
memory/1312-35-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/1312-37-0x00000000741D0000-0x0000000074980000-memory.dmp

Filesize
7.7MB

Download
memory/1312-41-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-77-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-97-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-93-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-91-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-89-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-85-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-83-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-81-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-79-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-73-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-71-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-67-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-65-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-63-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-59-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-55-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-53-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-51-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-49-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-47-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-45-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-95-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-87-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-43-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-75-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-69-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-39-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-61-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-57-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-38-0x0000000005140000-0x000000000518F000-memory.dmp

Filesize
316KB

Download
memory/1312-1132-0x00000000741D0000-0x0000000074980000-memory.dmp

Filesize
7.7MB

Download
memory/1312-1133-0x0000000005340000-0x00000000053A6000-memory.dmp

Filesize
408KB

Download
memory/1312-1134-0x00000000067C0000-0x0000000006810000-memory.dmp

Filesize
320KB

Download
memory/1312-1135-0x00000000068B0000-0x000000000694C000-memory.dmp

Filesize
624KB

Download
memory/1312-1136-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1312-1137-0x00000000741DE000-0x00000000741DF000-memory.dmp

Filesize
4KB

Download
memory/1312-1138-0x00000000741D0000-0x0000000074980000-memory.dmp

Filesize
7.7MB

Download
memory/1312-1139-0x00000000741D0000-0x0000000074980000-memory.dmp

Filesize
7.7MB

Download
memory/1312-1140-0x00000000069F0000-0x0000000006A82000-memory.dmp

Filesize
584KB

Download
memory/1312-1141-0x0000000006980000-0x000000000698A000-memory.dmp

Filesize
40KB

Download
memory/1312-1142-0x00000000741D0000-0x0000000074980000-memory.dmp

Filesize
7.7MB

Download
memory/3284-10-0x0000000003FF0000-0x0000000003FF4000-memory.dmp

Filesize
16KB

Download