agenttesla | 7b01e7eaa276275cb58f890900e7852f59be59905804ecae7d0011a58c8ca2fa

General

Target

Inquiry 8700.exe
Size

515KB
MD5

8d1958f3ff1bd3cb56b6c9e6e0d75c4a
SHA1

596a1a28554786ce343e9ea0aaa69a76bc28d8e2
SHA256

7b01e7eaa276275cb58f890900e7852f59be59905804ecae7d0011a58c8ca2fa
SHA512

9835fe7298aa1c567aee2855ccb8aafe393c7933af06346d55e441db423b891982c5aa244c56263452832e52de59c3d926db5c27dbcc73b35861e7cab78f2eee

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
johnsonpikyu@yandex.com
Password:
cr*fDaW&m@2y6u

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

Processes:

Inquiry 8700.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com.br\ = "6"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com.br\ = "0"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com.br\Total = "0"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "391"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "397"	Inquiry 8700.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Inquiry 8700.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com.br\ = "391"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com.br\Total = "391"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com.br\NumberOfSubdomains = "1"	Inquiry 8700.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com.br	Inquiry 8700.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage	Inquiry 8700.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com.br	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com.br\Total = "6"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com.br\Total = "397"	Inquiry 8700.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com.br\ = "397"	Inquiry 8700.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	Inquiry 8700.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Inquiry 8700.exe

pid process

4636 Inquiry 8700.exe
4636 Inquiry 8700.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Inquiry 8700.exe

description pid process

Token: SeDebugPrivilege 4636 Inquiry 8700.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Inquiry 8700.exe

pid process

4636 Inquiry 8700.exe
4636 Inquiry 8700.exe

pid	process
4636	Inquiry 8700.exe
4636	Inquiry 8700.exe

description	pid	process
Token: SeDebugPrivilege	4636	Inquiry 8700.exe

pid	process
4636	Inquiry 8700.exe
4636	Inquiry 8700.exe

C:\Users\Admin\AppData\Local\Temp\Inquiry 8700.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry 8700.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4636