agenttesla | 679e3b146fe4ae9eb288b02f61958fedf2b454f843ed2ca61f620ad789dd32be

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

001 Tech. Spec pdf.exe
Size

1.0MB
MD5

3fa2d76350df22a5286ecdc385a9d12c
SHA1

db07b72343c0767743ac021ff29896a571028fe3
SHA256

679e3b146fe4ae9eb288b02f61958fedf2b454f843ed2ca61f620ad789dd32be
SHA512

ad9e294c39496accff57d4754906e42f4167ffb7090b5aadc009b35e94cc1717b0beabd78319719cc03ac40f0d782cbb830b19fe8d56e2c953a366fb6fede321
SSDEEP

24576:oAHnh+eWsN3skA4RV1Hom2KXMmHayVG3xKEp0kYOEbdiRbp5:vh+ZkldoPK8Yay2KEpZNEbdCf

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
w#chNV#1
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZUHFqcY = "C:\\Users\\Admin\\AppData\\Roaming\\ZUHFqcY\\ZUHFqcY.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

001 Tech. Spec pdf.exe

description pid process target process

PID 2656 set thread context of 2600 2656 001 Tech. Spec pdf.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2600 RegSvcs.exe
2600 RegSvcs.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

001 Tech. Spec pdf.exe

pid process

2656 001 Tech. Spec pdf.exe
2656 001 Tech. Spec pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2600 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

001 Tech. Spec pdf.exe

pid process

2656 001 Tech. Spec pdf.exe
2656 001 Tech. Spec pdf.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

001 Tech. Spec pdf.exe

pid process

2656 001 Tech. Spec pdf.exe
2656 001 Tech. Spec pdf.exe

flow	ioc
4	ip-api.com

description	pid	process	target process
PID 2656 set thread context of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe

pid	process
2600	RegSvcs.exe
2600	RegSvcs.exe

pid	process
2656	001 Tech. Spec pdf.exe
2656	001 Tech. Spec pdf.exe

description	pid	process
Token: SeDebugPrivilege	2600	RegSvcs.exe

pid	process
2656	001 Tech. Spec pdf.exe
2656	001 Tech. Spec pdf.exe

pid	process
2656	001 Tech. Spec pdf.exe
2656	001 Tech. Spec pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

001 Tech. Spec pdf.exe

description	pid	process	target process
PID 2656 wrote to memory of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe
PID 2656 wrote to memory of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe
PID 2656 wrote to memory of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe
PID 2656 wrote to memory of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe
PID 2656 wrote to memory of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe
PID 2656 wrote to memory of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe
PID 2656 wrote to memory of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe
PID 2656 wrote to memory of 2600	2656	001 Tech. Spec pdf.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\001 Tech. Spec pdf.exe
"C:\Users\Admin\AppData\Local\Temp\001 Tech. Spec pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\001 Tech. Spec pdf.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-11-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download
memory/2600-13-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download
memory/2600-20-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download
memory/2600-17-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download
memory/2600-21-0x0000000073CEE000-0x0000000073CEF000-memory.dmp

Filesize
4KB

Download
memory/2600-22-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/2600-24-0x0000000073CEE000-0x0000000073CEF000-memory.dmp

Filesize
4KB

Download
memory/2600-25-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/2656-10-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download