agenttesla | 818d6ad42f3e392fd415226c37ff05575fa913df3bc9493ea70837afffb9a2ac

Analysis

max time kernel
145s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

agentesla/06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
Size

366KB
MD5

b29263b5d35ffce3eef6a54549966724
SHA1

23d474b87f0698a3c954aeeffc9e2b7777aa8731
SHA256

06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871
SHA512

ecdb4111613d82b06d23cb6d57ce0c1e48f06e8fa44e9c32a478a58e377bfe3170037e049035cc8b90dda74b228e52962035378c8b01cf9c6c2bd9120aaf7688
SSDEEP

6144:OOTNj/znzNEu816TkUzhD6dmo9FUiK2FpSMtZSYVM/SxRCVEt1Lakl:3j/znzNEu816T5zhD6Yq5Fp37SYbTaML

Score

10^/10

agenttesla asyncrat remcos default host discovery execution keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.globalifb.com
Port:
587
Username:
[email protected]
Password:
$;oGh3?)CQiY
Email To:
[email protected]

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

104.129.27.19:6606

104.129.27.19:7707

104.129.27.19:8808

Mutex

ppUf6LQ00ujy

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

104.129.27.19:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%WinDir%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_lojuxaaqmwpnhvc
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchostservice.exe	family_asyncrat

Executes dropped EXE 4 IoCs

Processes:

dllhostservices.execrss.exesvchostservice.exeHWMonitor.exe

pid process

804 dllhostservices.exe
2836 crss.exe
2748 svchostservice.exe
2872 HWMonitor.exe

pid	process
804	dllhostservices.exe
2836	crss.exe
2748	svchostservice.exe
2872	HWMonitor.exe

Loads dropped DLL 5 IoCs

Processes:

06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.execrss.exe

pid	process
2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
2836	crss.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\HWMonitor = "C:\\Windows\\system32\\HWMonitor\\HWMonitor.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2368 powershell.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org

pid	process
2368	powershell.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

crss.exeHWMonitor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HWMonitor\HWMonitor.exe	crss.exe
File created	C:\Windows\SysWOW64\HWMonitor\HWMonitor.exe	HWMonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

HWMonitor.exepowershell.exe06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.execrss.exedllhostservices.exesvchostservice.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HWMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhostservices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchostservice.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

crss.exeHWMonitor.exe

pid process

2836 crss.exe
2872 HWMonitor.exe

pid	process
2836	crss.exe
2872	HWMonitor.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exepowershell.exe

pid	process
2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
Token: SeDebugPrivilege	2368	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dllhostservices.exe06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe

pid process

804 dllhostservices.exe
2092 06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe

pid	process
804	dllhostservices.exe
2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.execrss.exe

description	pid	process	target process
PID 2092 wrote to memory of 804	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	dllhostservices.exe
PID 2092 wrote to memory of 804	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	dllhostservices.exe
PID 2092 wrote to memory of 804	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	dllhostservices.exe
PID 2092 wrote to memory of 804	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	dllhostservices.exe
PID 2092 wrote to memory of 2836	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	crss.exe
PID 2092 wrote to memory of 2836	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	crss.exe
PID 2092 wrote to memory of 2836	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	crss.exe
PID 2092 wrote to memory of 2836	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	crss.exe
PID 2092 wrote to memory of 2748	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	svchostservice.exe
PID 2092 wrote to memory of 2748	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	svchostservice.exe
PID 2092 wrote to memory of 2748	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	svchostservice.exe
PID 2092 wrote to memory of 2748	2092	06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe	svchostservice.exe
PID 2836 wrote to memory of 2368	2836	crss.exe	powershell.exe
PID 2836 wrote to memory of 2368	2836	crss.exe	powershell.exe
PID 2836 wrote to memory of 2368	2836	crss.exe	powershell.exe
PID 2836 wrote to memory of 2368	2836	crss.exe	powershell.exe
PID 2836 wrote to memory of 2872	2836	crss.exe	HWMonitor.exe
PID 2836 wrote to memory of 2872	2836	crss.exe	HWMonitor.exe
PID 2836 wrote to memory of 2872	2836	crss.exe	HWMonitor.exe
PID 2836 wrote to memory of 2872	2836	crss.exe	HWMonitor.exe

C:\Users\Admin\AppData\Local\Temp\agentesla\06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe
"C:\Users\Admin\AppData\Local\Temp\agentesla\06c9e20878f14ce4cba1a0c2bc40117f609a550543a2aecba751c17851fb1871.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\dllhostservices.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\dllhostservices.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:804

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\crss.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\crss.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor' -Value '"C:\Windows\system32\HWMonitor\HWMonitor.exe"' -PropertyType 'String'
3⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\SysWOW64\HWMonitor\HWMonitor.exe
"C:\Windows\system32\HWMonitor\HWMonitor.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
PID:2872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchostservice.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchostservice.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\crss.exe

Filesize
10KB

MD5
caf9747a01a99245a0b3df133dd85191

SHA1
c8429f9d5d1d9768e22019fcac5f0d4b59c006a6

SHA256
6d0d83d060bc279825425757101698e702f3e71c53639270c63b24216fcbcd3f

SHA512
efde236d9924598aa1b3b54b1711b9bbea194bd4a392781aa3c71dca55a0e0188bc8452468497538ee7444ee8803ab4c5865f821fd7aba60b811ed72ebd57ce7

Download Submit
C:\Windows\SysWOW64\HWMonitor\HWMonitor.exe

Filesize
43.2MB

MD5
897e249d6cc0f454afc3537f1e65789e

SHA1
f18732daed25333c413f755a266cec4a6d99601d

SHA256
8df786b91f831472df705c54deb425915e42259d96a05ba31c79ee6fce4c97d8

SHA512
1714659faf55eb113cab4275125b0796eb6c99f812204ca73c04e01248b0af918e05a8804a7ee2bfd7514d7192ec2afb8a481b391cbfa881e57878e25104b0cd

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\dllhostservices.exe

Filesize
36KB

MD5
64836f3e257a5b415711abc3b6ea6323

SHA1
f52f8588801554eaf4e495784b84f830c4afeaf4

SHA256
3f02a631dce0c4a4acd39ca731eae0ebda74ea65bfe90573d2ab226bab1dc234

SHA512
f3418f421ff0d0bfefd37e5ad75f9d2ffe40953333b90a01ab015942f36333fc4c0e03e468e725e6d8bb5573d9c058aeb889336fee77099db2ddfdfd1a7822f9

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchostservice.exe

Filesize
45KB

MD5
962b8a0da7f38404ae75698d445d2f82

SHA1
afefd1bc3f70d9a03621a22715ea1001a8d4427b

SHA256
940d979a6e48061d85288ff57e6865087d7c0362774bd7d2caebfdc7b02914eb

SHA512
e1092a2f4c3877eca9d6f67b4da78fecae66bc5fd49d190f796358c245b005a3c6fbd49496bfb4b1ea688c6719c0ca4f963f49b192c97dcb518d5cd4c42bbc68

Download Submit
memory/804-35-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/804-59-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/804-57-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/804-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/804-14-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/804-52-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/804-38-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2092-34-0x0000000004490000-0x00000000044A9000-memory.dmp

Filesize
100KB

Download
memory/2092-32-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-33-0x0000000004490000-0x00000000044A9000-memory.dmp

Filesize
100KB

Download
memory/2092-31-0x00000000749FE000-0x00000000749FF000-memory.dmp

Filesize
4KB

Download
memory/2092-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

Filesize
4KB

Download
memory/2092-12-0x0000000004490000-0x00000000044A9000-memory.dmp

Filesize
100KB

Download
memory/2092-13-0x0000000004490000-0x00000000044A9000-memory.dmp

Filesize
100KB

Download
memory/2092-2-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-1-0x0000000001020000-0x0000000001082000-memory.dmp

Filesize
392KB

Download
memory/2748-30-0x0000000000130000-0x0000000000142000-memory.dmp

Filesize
72KB

Download
memory/2836-23-0x0000000000FC0000-0x0000000000FC8000-memory.dmp

Filesize
32KB

Download
memory/2872-46-0x0000000000040000-0x0000000000048000-memory.dmp

Filesize
32KB

Download