agenttesla | ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe
Size 10KB
Sample241112-dl14xstdqd
SHA256 ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae
MD5 254471760724bb645f41689c3bdc6dac
SHA1 ceda7f23ac91b4af194c758b3c6e5b9100766da4
SHA512 f18fad6ae29adb4fca5b4b1a3d525062f955bc94ec89d4d913e6b0d802838ed428ecfdc42c18ae8950814889d0636bb47598236163e2a138dea8062431a04867
SSDEEP 192:7QiwcCrwQiaIf536yhD1uFyQ3NvR13N1QZd9N0FK:2c+wQhQ53ZD8Fj3tRVN1M/NF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
162.254.34.31
Port
587
Username
[email protected]
Password
M992uew1mw6Z
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	3184	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	api.ipify.org
54	api.ipify.org

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 4040	4884	powershell.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	1	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3396	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4884	powershell.exe
4884	powershell.exe
3816	powershell.exe
3816	powershell.exe
3816	powershell.exe
4884	powershell.exe
4884	powershell.exe
4040	MSBuild.exe
4040	MSBuild.exe
4040	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	4040	MSBuild.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE
3396	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4884	2444	WScript.exe	97
PID 2444 wrote to memory of 4884	2444	WScript.exe	97
PID 2444 wrote to memory of 3816	2444	WScript.exe	107
PID 2444 wrote to memory of 3816	2444	WScript.exe	107
PID 4884 wrote to memory of 4040	4884	powershell.exe	109
PID 4884 wrote to memory of 4040	4884	powershell.exe	109
PID 4884 wrote to memory of 4040	4884	powershell.exe	109
PID 4884 wrote to memory of 4040	4884	powershell.exe	109
PID 4884 wrote to memory of 4040	4884	powershell.exe	109
PID 4884 wrote to memory of 4040	4884	powershell.exe	109
PID 4884 wrote to memory of 4040	4884	powershell.exe	109
PID 4884 wrote to memory of 4040	4884	powershell.exe	109
PID 3816 wrote to memory of 1032	3816	powershell.exe	111
PID 3816 wrote to memory of 1032	3816	powershell.exe	111
PID 4884 wrote to memory of 4460	4884	powershell.exe	110
PID 4884 wrote to memory of 4460	4884	powershell.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef670fb4793463bc81ae7f07fc809bab0962fec614a3fef3bc779a4a382c2eae.vbe"
1⤵
- Blocklisted process makes network request
PID:3184

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4884" "2884" "2812" "2888" "0" "0" "2892" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4460
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3816" "2688" "2648" "2692" "0" "0" "2696" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1032

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ShowProtect.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 d4af1948337d0deb725f4f2b1fe1a9b60f4519841e28748b11bfd62ccd71e028
MD5 9461a7cfb20ff5381df28f51b80c5ef1
SHA1 c86c53fca1dcbe307dafbefbb366abf52c9f5eca
SHA512 da1e17f67dfebb004ba93d489be504fd7af6d62709ada2581ffa77880baecdaa0015b49d36333d18216d9dc6aad7b0ea2e5bd224d8d3f65ee9b66a05fc45e304
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 0b0e6bd2aa2a2296ab8de04d5009393e04d0fb478fcd0fd24f0d3beabef94275
MD5 e471065a1b3dd2a880666e8f93c0299f
SHA1 c4bb2ab71b256d7b1665bb857f22cfa6c76b0150
SHA512 1724e8f50e5d9414bbbe9fcc5dc4267584dbec57615abc787898b0830460bd0e35f1e27f67a2e1d8010dff10856486178048de0d0679c6e180c4af2a388749a9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lpo5krzj.akw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lpo5krzj.akw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

LPFpWIHXbpdnRBc.vbs

Path C:\Users\Admin\AppData\Roaming\LPFpWIHXbpdnRBc.vbs
Size 1KB
SHA256 7ea2c1cdb0947698fcc82e9c7624c63a92d73671dd48d368a35c968a77a6cfac
MD5 5b12725548e7be334795090aab4c663a
SHA1 3f3cfaba2d7d57817d08f73b6693c7ed7c632932
SHA512 14ea70502134fd28f709071da5d9a1adf4fe7fc08fea5afdc22092374043219eb5bae6a8506000efbcf231bc05162ab34d2fc95015156ac3fbc84da35ab8b928
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 358B
SHA256 4dfc6d2a56591886b2ee22312e7e7aed4b0082f8b3ff95892c25c92a91bee994
MD5 e08434ddd350335ae8a5d3b88c7f3bc3
SHA1 85b1dcc343eb166772ea4beb8c49ebfc129f5d16
SHA512 c5c5ed859c2d9e4127cebace39abb0e2271074fd531307730834113db8bb7ba44899eaf01f72e39e0d2cb44032cd592ca8b390d6171e51826c9b0f9cd5c347ad
MD5 SHA1 SHA512

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 217B
SHA256 7ea83c30e1d4e70a25a321d67188aa031581f4533141f6219c63c7d96f6273c1
MD5 36a3f1f08aaa7f5bd7e821d0b49c3008
SHA1 d5d2cf910666d7ec117179023e5b040ddc376dd2
SHA512 f0a1e1c42a224f65aeb0c293c6180c12b5c374685f9bd8d2104046546a31a91929f748b6ad47744824edf9af03da042ca1aec66faa2c33a288ce61ab6e88c3c5
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 0ec20ac5ecb9fa252a7b3e0163f36cfe529310dd9ed3754d363eca6ebefab8c1
MD5 9df996a233fbbed30f94630780fcfc3a
SHA1 3e10110979768ba99de8d87a374e5c2b221580ae
SHA512 65145b86cf9388adbc9d371f2633bd150134596bbda124f09415b08727d9b2a307eed160cb52a7f0e24e56fabee919fec811428c180ebaa31f694205b2bff490
SSDEEP 96:WscZCvXCFukvhkvCCtISVdXvAQHejVdXvAQHec:WscSScI+/Aln/Alc
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 ca139020a41563dc81f2faa5cae14e6665c32a155f79ce6811558e228add3a62
MD5 2f07685ea3cc28d551db00e6d1cc246e
SHA1 6a09b8b4b50b84dc5a4547b74fb8cb0f343a8513
SHA512 861b6d4bbd32570b052852a3f855d9ef076f286eec6835e72b3d0071158edc38e990ffade576281edd55a07f3b453cf2a45f2024e8587127ed94f150fa00abb8
SSDEEP 96:6seZCyX6FukvhkvCCtISVdXvAQHejVdXvAQHec:6seDKcI+/Aln/Alc
MD5 SHA1 SHA512 SSDEEP

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 d509afbc041c0c89ef02c42958aaf2c71d06e66cb922fcdc30b79ad2d5d7f107
MD5 912142518f22b1ce19e4c25765018d36
SHA1 00916ef0f26ff318a96c375629872492a829a7db
SHA512 a9bd43307ec0d848e6a17cf4c3cefc2da39b83bf74414661af0c815a9590b823e318312c669cf1a666d325172903bae43fbc6ecbde7f98f02d6120bc71559c75
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 fed2a2226d71249c12370a91aa5057a5fa97378fab3b5823944002d9edc2cdf9
MD5 a91ac6b399eee533c963b86cff1c9b36
SHA1 15f9002c736e5973e71a4c3159b7cc6aa16d3e67
SHA512 1e4ca876033523e6bbe106831cbf01d3633a29790e58a81c50a64b0aa12160a9b59fe608ca8acfa08de9454115b049d590b8a45d4cd036778b9aca07bf440cd4
MD5 SHA1 SHA512

Submit Download

memory/3396-17-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

Download

memory/3396-22-0x00007FF89A110000-0x00007FF89A120000-memory.dmp

Download

memory/3396-21-0x00007FF89A110000-0x00007FF89A120000-memory.dmp

Download

memory/3396-20-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

Download

memory/3396-19-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

Download

memory/3396-18-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

Download

memory/3396-16-0x00007FF89CA70000-0x00007FF89CA80000-memory.dmp

Download

memory/4040-100-0x00000000053E0000-0x0000000005984000-memory.dmp

Download

memory/4040-80-0x0000000000A00000-0x0000000000A40000-memory.dmp

Download

memory/4040-101-0x0000000005060000-0x00000000050C6000-memory.dmp

Download

memory/4040-102-0x0000000006470000-0x00000000064C0000-memory.dmp

Download

memory/4040-103-0x0000000006560000-0x00000000065F2000-memory.dmp

Download

memory/4040-104-0x00000000064E0000-0x00000000064EA000-memory.dmp

Download

memory/4884-78-0x000002E171250000-0x000002E171258000-memory.dmp

Download

memory/4884-79-0x000002E1733C0000-0x000002E1733CC000-memory.dmp

Download

memory/4884-14-0x000002E173890000-0x000002E1738D4000-memory.dmp

Download

memory/4884-6-0x000002E1733D0000-0x000002E1733F2000-memory.dmp

Download

memory/4884-15-0x000002E173960000-0x000002E1739D6000-memory.dmp

Download