agenttesla | fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
Size

1.1MB
MD5

657278fd67cfa173ce3bcf668b4a86d0
SHA1

b859e907f9a1707dbe3a2da1235393e5a5069825
SHA256

fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58
SHA512

23c5fed47b6e12661a6fab6907f515261c29ad1eaa8108e995d4c26940b58ca5b2699d02884d4fcceb9c0e6f3a3bc739b66efc2378a64267f14a7c6914ced339
SSDEEP

24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8aI3QrSeyEpylooK:QTvC/MTQYxsWR7ag8AOXo

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.jaszredony.hu
Port:
587
Username:
[email protected]
Password:
jRedony77
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Drops startup file 1 IoCs

Processes:

name.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe
Executes dropped EXE 1 IoCs

Processes:

name.exe

pid process

2084 name.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

pid	process
2084	name.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newfile = "C:\\Users\\Admin\\AppData\\Roaming\\newfile\\newfile.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

26 ip-api.com
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\directory\name.exe autoit_exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

name.exe

description pid process target process

PID 2084 set thread context of 1836 2084 name.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1836 RegSvcs.exe
1836 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

name.exe

pid process

2084 name.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1836 RegSvcs.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exename.exe

pid process

4472 fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
4472 fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
2084 name.exe
2084 name.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exename.exe

pid process

4472 fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
4472 fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
2084 name.exe
2084 name.exe

flow	ioc
26	ip-api.com

resource	yara_rule
C:\Users\Admin\AppData\Local\directory\name.exe	autoit_exe

description	pid	process	target process
PID 2084 set thread context of 1836	2084	name.exe	RegSvcs.exe

pid	process
1836	RegSvcs.exe
1836	RegSvcs.exe

pid	process
2084	name.exe

description	pid	process
Token: SeDebugPrivilege	1836	RegSvcs.exe

pid	process
4472	fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
4472	fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
2084	name.exe
2084	name.exe

pid	process
4472	fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
4472	fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
2084	name.exe
2084	name.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exename.exe

description	pid	process	target process
PID 4472 wrote to memory of 2084	4472	fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe	name.exe
PID 4472 wrote to memory of 2084	4472	fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe	name.exe
PID 4472 wrote to memory of 2084	4472	fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe	name.exe
PID 2084 wrote to memory of 1836	2084	name.exe	RegSvcs.exe
PID 2084 wrote to memory of 1836	2084	name.exe	RegSvcs.exe
PID 2084 wrote to memory of 1836	2084	name.exe	RegSvcs.exe
PID 2084 wrote to memory of 1836	2084	name.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe
"C:\Users\Admin\AppData\Local\Temp\fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472

C:\Users\Admin\AppData\Local\directory\name.exe
"C:\Users\Admin\AppData\Local\Temp\fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58.exe"
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hezron
Filesize
29KB

MD5
d0e82a4781f81bd4486634536eebb589

SHA1
5d573857af1926861d8de98f474b7382dca6877f

SHA256
d61157384a03673887316175a79369ada3063ac1292209816cd7eedef3a56676

SHA512
f9bd41e60d8b3d3d217557ee5292e47334f2f2ad29fe27fefc91f4761dccc839626f3a14c78ad9503fe745fbaea13333b72cc099e70c6bfbada4785e6a45c717

Download Submit
C:\Users\Admin\AppData\Local\Temp\polygamodioecious
Filesize
239KB

MD5
fc362e15f498e885a66f2b3ab58b801a

SHA1
c3a3f6b8490b7b454c5322b3220e6ea153bb18e3

SHA256
76954e99d815bffaa5300519c2a91c14888373f5bd3fc473b61d3d2582bcee1d

SHA512
fc0ba808857ebd55caf26b8f7a81300e7788570f2a8abd8b4f0388f06253cccbe1c2f48f2a0b920255b4ed1e238ccbf6216b1767f0d67fa45de867655fbc1e9e

Download Submit
C:\Users\Admin\AppData\Local\directory\name.exe
Filesize
1.1MB

MD5
657278fd67cfa173ce3bcf668b4a86d0

SHA1
b859e907f9a1707dbe3a2da1235393e5a5069825

SHA256
fb4df4937ba91dc7e928297ac5f9423f197600599bf72890890225342e6b9f58

SHA512
23c5fed47b6e12661a6fab6907f515261c29ad1eaa8108e995d4c26940b58ca5b2699d02884d4fcceb9c0e6f3a3bc739b66efc2378a64267f14a7c6914ced339

Download Submit
memory/1836-30-0x00000000058A0000-0x0000000005E44000-memory.dmp

Filesize
5.6MB

Download
memory/1836-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1836-29-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1836-31-0x0000000005360000-0x00000000053C6000-memory.dmp

Filesize
408KB

Download
memory/1836-32-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/1836-34-0x0000000006510000-0x0000000006560000-memory.dmp

Filesize
320KB

Download
memory/1836-35-0x0000000006600000-0x0000000006692000-memory.dmp

Filesize
584KB

Download
memory/1836-36-0x0000000006590000-0x000000000659A000-memory.dmp

Filesize
40KB

Download
memory/1836-37-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1836-38-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/4472-10-0x0000000000BF0000-0x0000000000BF4000-memory.dmp

Filesize
16KB

Download