agenttesla | 44b744d92edb4e6c39a37fcf3e6b96625445f31415c307692b3e902ca3f99144

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
Size

916KB
MD5

6702210599cb1c1dd3a332e2fd681785
SHA1

4ab8235f879e479c4dabaf83ff41544dc24d8bf7
SHA256

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SHA512

07747f2d10d3cd07c2b0087092f82879b18a471cd507d7971b7ac92fe476fce6d464a346c862cf298de701b2439d53984e610c5472da6425fe77c98244eac579
SSDEEP

24576:cP0tkNRBASM38mWceqOqNLEIw4fgPKvUZ3AP82:cP0+bBA58mWe3LX

Score

10^/10

agenttesla collection execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2524 powershell.exe
2836 powershell.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2524	powershell.exe
2836	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

description	pid	process	target process
PID 2424 set thread context of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3052 schtasks.exe

pid	process
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exede8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exepowershell.exepowershell.exe

pid	process
2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
2756	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
2756	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
2524	powershell.exe
2836	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

pid process

2756 de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

pid	process
2756	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exede8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
Token: SeDebugPrivilege	2756	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

pid process

2756 de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

pid	process
2756	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

description	pid	process	target process
PID 2424 wrote to memory of 2524	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	powershell.exe
PID 2424 wrote to memory of 2524	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	powershell.exe
PID 2424 wrote to memory of 2524	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	powershell.exe
PID 2424 wrote to memory of 2524	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	powershell.exe
PID 2424 wrote to memory of 2836	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	powershell.exe
PID 2424 wrote to memory of 2836	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	powershell.exe
PID 2424 wrote to memory of 2836	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	powershell.exe
PID 2424 wrote to memory of 2836	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	powershell.exe
PID 2424 wrote to memory of 3052	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	schtasks.exe
PID 2424 wrote to memory of 3052	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	schtasks.exe
PID 2424 wrote to memory of 3052	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	schtasks.exe
PID 2424 wrote to memory of 3052	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	schtasks.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
PID 2424 wrote to memory of 2756	2424	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

outlook_office_path 1 IoCs

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

outlook_win_path 1 IoCs

Processes:

de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe

C:\Users\Admin\AppData\Local\Temp\de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
"C:\Users\Admin\AppData\Local\Temp\de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nOAiyaZU.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nOAiyaZU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpACA4.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Users\Admin\AppData\Local\Temp\de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe
"C:\Users\Admin\AppData\Local\Temp\de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2756

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpACA4.tmp
Filesize
1KB

MD5
7387c9025df6a8f919e6644cd47aceea

SHA1
3447cca89d966608f8752aa4a8093916e1143ea1

SHA256
3eddfb00f4ff771518b293eb7806d0ce1b24dfa3880e928783605535e3b4ef94

SHA512
e0418717e6546fae38c70bbb94496695d0101c5c4e237820caa0de6fc1477211eb253d793b2fd7227737f83e03485b78cefcb15523bd823cb667b2e1b41507d8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
be3b69764e1ede2c60617c736bbda9bd

SHA1
480981e6d58e15cf854a90bd0eae10e496749684

SHA256
4128ef4db82cdb76814751237c1f2a8d6de6c78b0bb5a55c674087f94c42259b

SHA512
857e12bb03fc235c43fb97edfee8c7b4bfbfbe3a904d23280199a0610681f939d97de2b073c085a5a0c76838ebc443ddc680e808251f1f2ebdb05f317b03d5ab

Download Submit
memory/2424-20-0x0000000000650000-0x00000000006BC000-memory.dmp

Filesize
432KB

Download
memory/2424-33-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2424-4-0x00000000741BE000-0x00000000741BF000-memory.dmp

Filesize
4KB

Download
memory/2424-5-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2424-6-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/2424-7-0x0000000005D00000-0x0000000005DA2000-memory.dmp

Filesize
648KB

Download
memory/2424-2-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2424-1-0x0000000000BD0000-0x0000000000CB8000-memory.dmp

Filesize
928KB

Download
memory/2424-0-0x00000000741BE000-0x00000000741BF000-memory.dmp

Filesize
4KB

Download
memory/2424-3-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2756-27-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2756-31-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2756-32-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2756-30-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2756-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2756-21-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2756-23-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2756-25-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download