agenttesla | 8363d012b83800ad66b80801e6267345d35a43ba6f1335baa5483332b36840a5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc20240627-00073.exe
Size

399KB
MD5

86ab45f914a047213012a783615a54fa
SHA1

42166d9321e30e79c33583e77a0d3de67e6142f2
SHA256

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527
SHA512

cbb6a1ccb8c4e28c8ea22c2ad881b7ef8c243c8e6f3abd5fc818d080a6b4417fb0ac5f412d488e46865fd5fe5db64e83b70c965e28fb65df9ac03696ee240a1f
SSDEEP

6144:bVGdx6xuO1TzGL7Bq0XtpZ+lsMA2Usp58ie1VvfpK70qkmXkbgn3/2tw7:ht1TzGLFtXtKxxEr1xg70ZEkbM3/2tw7

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sslout.de
Port:
587
Username:
[email protected]
Password:
dataset123
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 4 IoCs

Processes:

doc20240627-00073.exe

pid process

3912 doc20240627-00073.exe
3912 doc20240627-00073.exe
3912 doc20240627-00073.exe
3912 doc20240627-00073.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

37 ip-api.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

doc20240627-00073.exe

pid process

3472 doc20240627-00073.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

doc20240627-00073.exedoc20240627-00073.exe

pid process

3912 doc20240627-00073.exe
3472 doc20240627-00073.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

doc20240627-00073.exe

description pid process target process

PID 3912 set thread context of 3472 3912 doc20240627-00073.exe doc20240627-00073.exe
Drops file in Windows directory 1 IoCs

Processes:

doc20240627-00073.exe

description ioc process

File opened for modification C:\Windows\Sjavs.ini doc20240627-00073.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

doc20240627-00073.exe

pid process

3472 doc20240627-00073.exe
3472 doc20240627-00073.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

doc20240627-00073.exe

pid process

3912 doc20240627-00073.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

doc20240627-00073.exe

description pid process

Token: SeDebugPrivilege 3472 doc20240627-00073.exe

pid	process
3912	doc20240627-00073.exe
3912	doc20240627-00073.exe
3912	doc20240627-00073.exe
3912	doc20240627-00073.exe

flow	ioc
37	ip-api.com

pid	process
3472	doc20240627-00073.exe

pid	process
3912	doc20240627-00073.exe
3472	doc20240627-00073.exe

description	pid	process	target process
PID 3912 set thread context of 3472	3912	doc20240627-00073.exe	doc20240627-00073.exe

description	ioc	process
File opened for modification	C:\Windows\Sjavs.ini	doc20240627-00073.exe

pid	process
3472	doc20240627-00073.exe
3472	doc20240627-00073.exe

pid	process
3912	doc20240627-00073.exe

description	pid	process
Token: SeDebugPrivilege	3472	doc20240627-00073.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

doc20240627-00073.exe

description	pid	process	target process
PID 3912 wrote to memory of 3472	3912	doc20240627-00073.exe	doc20240627-00073.exe
PID 3912 wrote to memory of 3472	3912	doc20240627-00073.exe	doc20240627-00073.exe
PID 3912 wrote to memory of 3472	3912	doc20240627-00073.exe	doc20240627-00073.exe
PID 3912 wrote to memory of 3472	3912	doc20240627-00073.exe	doc20240627-00073.exe
PID 3912 wrote to memory of 3472	3912	doc20240627-00073.exe	doc20240627-00073.exe

C:\Users\Admin\AppData\Local\Temp\doc20240627-00073.exe
"C:\Users\Admin\AppData\Local\Temp\doc20240627-00073.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3912

C:\Users\Admin\AppData\Local\Temp\doc20240627-00073.exe
"C:\Users\Admin\AppData\Local\Temp\doc20240627-00073.exe"
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsm3FB9.tmp\BgImage.dll
Filesize
7KB

MD5
e9f3051a79f12aed819b91f028a463c1

SHA1
d088868584cdc04d391ec27cd318034a5ce562bc

SHA256
91b8073e8e67945e14fb10963fc9101fae8c298bd4cd7080b4e47b5bdd4af85c

SHA512
eac1fb48403959dc8a5ed20d8ced83c2276c510a781191c9f850bd3a9214c10c8ae0a4d9159dc3bb08f9686bc62f25dd31cccdcc48f568cc8678012333afe894

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm3FB9.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm3FB9.tmp\UserInfo.dll
Filesize
4KB

MD5
a6f622a2f12ac10bca04e23deff5cada

SHA1
abf851b5ccfb64004e9b49718a467bd754545887

SHA256
b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500

SHA512
35c8b0db179104e638f1b40f3f8038a41fdc327e112de5cb0dbb97cbf1dfa276fcf6400fcb46b88cb5ba233ca769becbdb4b4d40920adca831e3c0f38193c50f

Download Submit
memory/3472-43-0x0000000037A10000-0x0000000037A60000-memory.dmp

Filesize
320KB

Download
memory/3472-33-0x0000000001700000-0x00000000040E9000-memory.dmp

Filesize
41.9MB

Download
memory/3472-37-0x00000000004A0000-0x00000000016F4000-memory.dmp

Filesize
18.3MB

Download
memory/3472-39-0x00000000004A0000-0x00000000004E2000-memory.dmp

Filesize
264KB

Download
memory/3472-40-0x0000000036E20000-0x00000000373C4000-memory.dmp

Filesize
5.6MB

Download
memory/3472-41-0x0000000034820000-0x0000000034886000-memory.dmp

Filesize
408KB

Download
memory/3472-44-0x0000000037A60000-0x0000000037AF2000-memory.dmp

Filesize
584KB

Download
memory/3472-45-0x0000000036E00000-0x0000000036E0A000-memory.dmp

Filesize
40KB

Download
memory/3472-47-0x0000000001700000-0x00000000040E9000-memory.dmp

Filesize
41.9MB

Download
memory/3912-31-0x0000000077A41000-0x0000000077B61000-memory.dmp

Filesize
1.1MB

Download
memory/3912-32-0x0000000074724000-0x0000000074725000-memory.dmp

Filesize
4KB

Download
memory/3912-38-0x0000000004170000-0x0000000006B59000-memory.dmp

Filesize
41.9MB

Download
memory/3912-30-0x0000000004170000-0x0000000006B59000-memory.dmp

Filesize
41.9MB

Download