agenttesla | 4f3c0de5a08e918050382a42c6109fda68cc8167664065ebd98c73d761fde3f3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA pdf.exe
Size

717KB
MD5

0e928f8ca2a45826211c1e02c9ae09f8
SHA1

502ba9469f174b8ae062278be8ca847616d4e0f8
SHA256

3c4a6a16a5d8679e83400b100265e0513f5993e513d5f17c875976b09cd1bf25
SHA512

1ae4d75d15026e3277b42918756b1bc7a91960811136af4672ca48c9b943279b4ff22be4382275629693ae9f17b0c3e95ac1ade95c5bf167086015478aca4ca4
SSDEEP

12288:I3qyJMM/F1KswrqeiQgLI/VvH8WX1wMVeARbNPnN9jXBOQS6XczZLK4I7ukDkR:I6ON1KAYVvH8inwARbNPNNX3VMBK41kW

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tajhiz-gostaran.com
Port:
587
Username:
[email protected]
Password:
Ohv@dRNG{N^grViQHl
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2728 powershell.exe
2616 powershell.exe

pid	process
2728	powershell.exe
2616	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SOA pdf.exe

description pid process target process

PID 2244 set thread context of 2516 2244 SOA pdf.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2800 schtasks.exe
Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

SOA pdf.exeRegSvcs.exepowershell.exepowershell.exe

pid process

2244 SOA pdf.exe
2244 SOA pdf.exe
2244 SOA pdf.exe
2244 SOA pdf.exe
2244 SOA pdf.exe
2244 SOA pdf.exe
2244 SOA pdf.exe
2516 RegSvcs.exe
2516 RegSvcs.exe
2616 powershell.exe
2728 powershell.exe
Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SOA pdf.exeRegSvcs.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2244 SOA pdf.exe
Token: SeDebugPrivilege 2516 RegSvcs.exe
Token: SeDebugPrivilege 2616 powershell.exe
Token: SeDebugPrivilege 2728 powershell.exe

description	pid	process	target process
PID 2244 set thread context of 2516	2244	SOA pdf.exe	RegSvcs.exe

pid	process
2800	schtasks.exe

pid	process
2244	SOA pdf.exe
2244	SOA pdf.exe
2244	SOA pdf.exe
2244	SOA pdf.exe
2244	SOA pdf.exe
2244	SOA pdf.exe
2244	SOA pdf.exe
2516	RegSvcs.exe
2516	RegSvcs.exe
2616	powershell.exe
2728	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2244	SOA pdf.exe
Token: SeDebugPrivilege	2516	RegSvcs.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

SOA pdf.exe

description	pid	process	target process
PID 2244 wrote to memory of 2728	2244	SOA pdf.exe	powershell.exe
PID 2244 wrote to memory of 2728	2244	SOA pdf.exe	powershell.exe
PID 2244 wrote to memory of 2728	2244	SOA pdf.exe	powershell.exe
PID 2244 wrote to memory of 2728	2244	SOA pdf.exe	powershell.exe
PID 2244 wrote to memory of 2616	2244	SOA pdf.exe	powershell.exe
PID 2244 wrote to memory of 2616	2244	SOA pdf.exe	powershell.exe
PID 2244 wrote to memory of 2616	2244	SOA pdf.exe	powershell.exe
PID 2244 wrote to memory of 2616	2244	SOA pdf.exe	powershell.exe
PID 2244 wrote to memory of 2800	2244	SOA pdf.exe	schtasks.exe
PID 2244 wrote to memory of 2800	2244	SOA pdf.exe	schtasks.exe
PID 2244 wrote to memory of 2800	2244	SOA pdf.exe	schtasks.exe
PID 2244 wrote to memory of 2800	2244	SOA pdf.exe	schtasks.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe
PID 2244 wrote to memory of 2516	2244	SOA pdf.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SOA pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SOA pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA pdf.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TbRQjVqQYK.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TbRQjVqQYK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7687.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7687.tmp
Filesize
1KB

MD5
520c9f23a276dcbaadecf8ebba4c67e0

SHA1
7c44f426267f14c3835036e1e0474074e6baa713

SHA256
f6d36eb181c7a3027f0a3d48dbe96017102dce07dce0c4b0d60d1fad331f6f8a

SHA512
64a1cd61dec698e2b4f075e0f938382ee4de815b7aa65c9336a828436616e40d5bf61014fa5c4bd57aa4c275985898b4662f6e3fe1eaecefca66157dd9275ea3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NV3LTJZ77O5EKKDUEEEW.temp
Filesize
7KB

MD5
6153ae7455a146de2b4b4ee7033a4244

SHA1
9a406c31f072249f4ff5ad3ebb8e06b3c3856dec

SHA256
df1c0937fd112fa0c4b4fd0d828eff41d1d6a40162fcc3d56978054b9713942d

SHA512
de54ed4d9eec2785c087090eb3d94e28da6a795c188eb13c48a4cad747ae85196752a5f5ebe6b2ca92885e92315b911d1865399cfca965e9e697d5af36efd353

Download Submit
memory/2244-4-0x0000000000650000-0x000000000065E000-memory.dmp

Filesize
56KB

Download
memory/2244-32-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2244-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/2244-5-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/2244-6-0x0000000005040000-0x00000000050C2000-memory.dmp

Filesize
520KB

Download
memory/2244-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2244-1-0x0000000001040000-0x00000000010F4000-memory.dmp

Filesize
720KB

Download
memory/2244-3-0x00000000004C0000-0x00000000004D6000-memory.dmp

Filesize
88KB

Download
memory/2516-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2516-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2516-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2516-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2516-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2516-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2516-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2516-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download