agenttesla | 3e48d983e3315501931c646f896a8189637f5b9d21c453b051cd17f2584ee3c4

Analysis

max time kernel
149s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B6LNCKjOGt5EmFQ.exe
Size

1.8MB
MD5

80d255a6a5ec339e15d6fec3c0fef666
SHA1

bca665ff5a6a7084df2d424c0ed7fff3e141acbc
SHA256

3e48d983e3315501931c646f896a8189637f5b9d21c453b051cd17f2584ee3c4
SHA512

1bf61d60fc6646ff63786da850b4118fb15dcc6f2c831a8a80d58225cf55bfef395d69473afeae9d05f97c3adcedd90100c4266bc1d537b7f6d7f933cb6291c4

Score

10^/10

agenttesla hawkeye matiex keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.privateemail.com
Port:
587
Username:
sales01@seedwellresources.xyz
Password:
MARYolanmauluogwo@ever

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
smtp.privateemail.com
Port:
587
Username:
sales01@seedwellresources.xyz
Password:
MARYolanmauluogwo@ever

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.privateemail.com
Port:
587
Username:
sales01@seedwellresources.xyz
Password:
MARYolanmauluogwo@ever

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1068-13-0x0000000000400000-0x0000000000562000-memory.dmp	family_matiex
behavioral2/memory/1068-14-0x000000000040104C-mapping.dmp	family_matiex
C:\Users\Admin\AppData\Local\Temp\LOGO AND PICTURES.exe	family_matiex
C:\Users\Admin\AppData\Local\Temp\LOGO AND PICTURES.exe	family_matiex

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1068-13-0x0000000000400000-0x0000000000562000-memory.dmp	family_agenttesla
behavioral2/memory/1068-14-0x000000000040104C-mapping.dmp	family_agenttesla
C:\Users\Admin\AppData\Local\Temp\PO456724392021.exe	family_agenttesla
C:\Users\Admin\AppData\Local\Temp\PO456724392021.exe	family_agenttesla
C:\Users\Admin\AppData\Local\Temp\PO2345714382021.exe	family_agenttesla
C:\Users\Admin\AppData\Local\Temp\PO2345714382021.exe	family_agenttesla

NirSoft MailPassView 7 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/1068-13-0x0000000000400000-0x0000000000562000-memory.dmp	MailPassView
behavioral2/memory/1068-14-0x000000000040104C-mapping.dmp	MailPassView
C:\Users\Admin\AppData\Local\Temp\Pictures.exe	MailPassView
C:\Users\Admin\AppData\Local\Temp\Pictures.exe	MailPassView
behavioral2/memory/4668-45-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/4668-46-0x0000000000411654-mapping.dmp	MailPassView
behavioral2/memory/4668-47-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1068-13-0x0000000000400000-0x0000000000562000-memory.dmp	WebBrowserPassView
behavioral2/memory/1068-14-0x000000000040104C-mapping.dmp	WebBrowserPassView
C:\Users\Admin\AppData\Local\Temp\Pictures.exe	WebBrowserPassView
C:\Users\Admin\AppData\Local\Temp\Pictures.exe	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1068-13-0x0000000000400000-0x0000000000562000-memory.dmp	Nirsoft
behavioral2/memory/1068-14-0x000000000040104C-mapping.dmp	Nirsoft
C:\Users\Admin\AppData\Local\Temp\Pictures.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\Pictures.exe	Nirsoft
behavioral2/memory/4668-45-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4668-46-0x0000000000411654-mapping.dmp	Nirsoft
behavioral2/memory/4668-47-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

Executes dropped EXE 4 IoCs

Processes:

LOGO AND PICTURES.exePictures.exePO456724392021.exePO2345714382021.exe

pid process

1420 LOGO AND PICTURES.exe
1592 Pictures.exe
1680 PO456724392021.exe
1872 PO2345714382021.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 freegeoip.app
18 whatismyipaddress.com
12 checkip.dyndns.org
15 freegeoip.app

pid	process
1420	LOGO AND PICTURES.exe
1592	Pictures.exe
1680	PO456724392021.exe
1872	PO2345714382021.exe

flow	ioc
16	freegeoip.app
18	whatismyipaddress.com
12	checkip.dyndns.org
15	freegeoip.app

Suspicious use of SetThreadContext 2 IoCs

Processes:

B6LNCKjOGt5EmFQ.exePictures.exe

description	pid	process	target process
PID 4804 set thread context of 1068	4804	B6LNCKjOGt5EmFQ.exe	B6LNCKjOGt5EmFQ.exe
PID 1592 set thread context of 4668	1592	Pictures.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

840 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

B6LNCKjOGt5EmFQ.exePO2345714382021.exePO456724392021.exeLOGO AND PICTURES.exe

pid process

4804 B6LNCKjOGt5EmFQ.exe
1872 PO2345714382021.exe
1872 PO2345714382021.exe
1680 PO456724392021.exe
1680 PO456724392021.exe
1420 LOGO AND PICTURES.exe

pid	process
840	schtasks.exe

pid	process
4804	B6LNCKjOGt5EmFQ.exe
1872	PO2345714382021.exe
1872	PO2345714382021.exe
1680	PO456724392021.exe
1680	PO456724392021.exe
1420	LOGO AND PICTURES.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

B6LNCKjOGt5EmFQ.exePO2345714382021.exePO456724392021.exeLOGO AND PICTURES.exePictures.exe

description	pid	process
Token: SeDebugPrivilege	4804	B6LNCKjOGt5EmFQ.exe
Token: SeDebugPrivilege	1872	PO2345714382021.exe
Token: SeDebugPrivilege	1680	PO456724392021.exe
Token: SeDebugPrivilege	1420	LOGO AND PICTURES.exe
Token: SeDebugPrivilege	1592	Pictures.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

B6LNCKjOGt5EmFQ.exePictures.exeLOGO AND PICTURES.exe

pid process

1068 B6LNCKjOGt5EmFQ.exe
1592 Pictures.exe
1420 LOGO AND PICTURES.exe

pid	process
1068	B6LNCKjOGt5EmFQ.exe
1592	Pictures.exe
1420	LOGO AND PICTURES.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

B6LNCKjOGt5EmFQ.exeB6LNCKjOGt5EmFQ.exeLOGO AND PICTURES.exePictures.exe

description	pid	process	target process
PID 4804 wrote to memory of 840	4804	B6LNCKjOGt5EmFQ.exe	schtasks.exe
PID 4804 wrote to memory of 840	4804	B6LNCKjOGt5EmFQ.exe	schtasks.exe
PID 4804 wrote to memory of 840	4804	B6LNCKjOGt5EmFQ.exe	schtasks.exe
PID 4804 wrote to memory of 1068	4804	B6LNCKjOGt5EmFQ.exe	B6LNCKjOGt5EmFQ.exe
PID 4804 wrote to memory of 1068	4804	B6LNCKjOGt5EmFQ.exe	B6LNCKjOGt5EmFQ.exe
PID 4804 wrote to memory of 1068	4804	B6LNCKjOGt5EmFQ.exe	B6LNCKjOGt5EmFQ.exe
PID 4804 wrote to memory of 1068	4804	B6LNCKjOGt5EmFQ.exe	B6LNCKjOGt5EmFQ.exe
PID 4804 wrote to memory of 1068	4804	B6LNCKjOGt5EmFQ.exe	B6LNCKjOGt5EmFQ.exe
PID 4804 wrote to memory of 1068	4804	B6LNCKjOGt5EmFQ.exe	B6LNCKjOGt5EmFQ.exe
PID 4804 wrote to memory of 1068	4804	B6LNCKjOGt5EmFQ.exe	B6LNCKjOGt5EmFQ.exe
PID 1068 wrote to memory of 1420	1068	B6LNCKjOGt5EmFQ.exe	LOGO AND PICTURES.exe
PID 1068 wrote to memory of 1420	1068	B6LNCKjOGt5EmFQ.exe	LOGO AND PICTURES.exe
PID 1068 wrote to memory of 1420	1068	B6LNCKjOGt5EmFQ.exe	LOGO AND PICTURES.exe
PID 1068 wrote to memory of 1592	1068	B6LNCKjOGt5EmFQ.exe	Pictures.exe
PID 1068 wrote to memory of 1592	1068	B6LNCKjOGt5EmFQ.exe	Pictures.exe
PID 1068 wrote to memory of 1592	1068	B6LNCKjOGt5EmFQ.exe	Pictures.exe
PID 1068 wrote to memory of 1680	1068	B6LNCKjOGt5EmFQ.exe	PO456724392021.exe
PID 1068 wrote to memory of 1680	1068	B6LNCKjOGt5EmFQ.exe	PO456724392021.exe
PID 1068 wrote to memory of 1680	1068	B6LNCKjOGt5EmFQ.exe	PO456724392021.exe
PID 1068 wrote to memory of 1872	1068	B6LNCKjOGt5EmFQ.exe	PO2345714382021.exe
PID 1068 wrote to memory of 1872	1068	B6LNCKjOGt5EmFQ.exe	PO2345714382021.exe
PID 1068 wrote to memory of 1872	1068	B6LNCKjOGt5EmFQ.exe	PO2345714382021.exe
PID 1420 wrote to memory of 4544	1420	LOGO AND PICTURES.exe	netsh.exe
PID 1420 wrote to memory of 4544	1420	LOGO AND PICTURES.exe	netsh.exe
PID 1420 wrote to memory of 4544	1420	LOGO AND PICTURES.exe	netsh.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe
PID 1592 wrote to memory of 4668	1592	Pictures.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\B6LNCKjOGt5EmFQ.exe
"C:\Users\Admin\AppData\Local\Temp\B6LNCKjOGt5EmFQ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcVfsyyjYuQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8410.tmp"
2⤵
- Creates scheduled task(s)
PID:840

C:\Users\Admin\AppData\Local\Temp\B6LNCKjOGt5EmFQ.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Local\Temp\LOGO AND PICTURES.exe
"C:\Users\Admin\AppData\Local\Temp\LOGO AND PICTURES.exe" 0
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
4⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\Pictures.exe
"C:\Users\Admin\AppData\Local\Temp\Pictures.exe" 0
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
4⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\PO456724392021.exe
"C:\Users\Admin\AppData\Local\Temp\PO456724392021.exe" 0
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Users\Admin\AppData\Local\Temp\PO2345714382021.exe
"C:\Users\Admin\AppData\Local\Temp\PO2345714382021.exe" 0
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LOGO AND PICTURES.exe
MD5
d9001138c5119d936b70bf77e136afbe

SHA1
cfa2dbff8527715eaad00e91bd8955a8fffc1224

SHA256
9ae5ef3fd4feea105c1ed3f1e69fd4fa328e8f29f1937097280f7eee7f8d749e

SHA512
0187ec1ede0022daa4021a72d871ca0b7694b312bdba1c31bf3c0667ce0255c51e9880170a4b5226e63c2bf48f53b8071f12b08c106b6b82eb1d5389c3f9d576

Download Submit
C:\Users\Admin\AppData\Local\Temp\LOGO AND PICTURES.exe
MD5
d9001138c5119d936b70bf77e136afbe

SHA1
cfa2dbff8527715eaad00e91bd8955a8fffc1224

SHA256
9ae5ef3fd4feea105c1ed3f1e69fd4fa328e8f29f1937097280f7eee7f8d749e

SHA512
0187ec1ede0022daa4021a72d871ca0b7694b312bdba1c31bf3c0667ce0255c51e9880170a4b5226e63c2bf48f53b8071f12b08c106b6b82eb1d5389c3f9d576

Download Submit
C:\Users\Admin\AppData\Local\Temp\PO2345714382021.exe
MD5
9b79de8e3ad21f14e71e55cfa6ae4727

SHA1
3c2066345874febafe281bbde952d4f32d2ed53a

SHA256
56bd25acdb97ce17f8351b926c48a4f63e348c40f6c5913219b0745d99f6b31d

SHA512
f922be9228baa1dab85a5cfacfafbb6e8c919009bb843b6cdba0c2e24f6abfcbe26417046be248ccb41f820111633fdee7c6ea5865a2fbcc3bcf22c52a7208e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\PO2345714382021.exe
MD5
9b79de8e3ad21f14e71e55cfa6ae4727

SHA1
3c2066345874febafe281bbde952d4f32d2ed53a

SHA256
56bd25acdb97ce17f8351b926c48a4f63e348c40f6c5913219b0745d99f6b31d

SHA512
f922be9228baa1dab85a5cfacfafbb6e8c919009bb843b6cdba0c2e24f6abfcbe26417046be248ccb41f820111633fdee7c6ea5865a2fbcc3bcf22c52a7208e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\PO456724392021.exe
MD5
f38e2d474c075eff35b4ef81fdaca650

SHA1
13f869037c80be3cd4736c5f67431161c79e5970

SHA256
f9ee81b7def0b0008cef43847fb9ba520c0b57a49e7a71b47ff8d6ee1fec4298

SHA512
b57a699e88f2ed2d83901be6362663bfa98944a95e74f0e8d36622868a7ad04f9d557b617bd71a9a69fd7b7b1e7143edeaaff0a5e54d81311f78f8497fdea649

Download Submit
C:\Users\Admin\AppData\Local\Temp\PO456724392021.exe
MD5
f38e2d474c075eff35b4ef81fdaca650

SHA1
13f869037c80be3cd4736c5f67431161c79e5970

SHA256
f9ee81b7def0b0008cef43847fb9ba520c0b57a49e7a71b47ff8d6ee1fec4298

SHA512
b57a699e88f2ed2d83901be6362663bfa98944a95e74f0e8d36622868a7ad04f9d557b617bd71a9a69fd7b7b1e7143edeaaff0a5e54d81311f78f8497fdea649

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pictures.exe
MD5
25146e9c5ecd498dd17ba01e6cfaeb24

SHA1
4171900e4d1291c7a7cdb33adc655ecb12334a4f

SHA256
5207f3d079a52017e7977296c9eba782d3d5eae5adec94fa38acdd88c184496d

SHA512
18374c6619b5f3d310db43e5f81db1333bdc9dc4086910fe2724a406d445ccbf5b16463b9341fbe718b2aae9e929a2302655f3964eb64b47f2d80418b46e478f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pictures.exe
MD5
25146e9c5ecd498dd17ba01e6cfaeb24

SHA1
4171900e4d1291c7a7cdb33adc655ecb12334a4f

SHA256
5207f3d079a52017e7977296c9eba782d3d5eae5adec94fa38acdd88c184496d

SHA512
18374c6619b5f3d310db43e5f81db1333bdc9dc4086910fe2724a406d445ccbf5b16463b9341fbe718b2aae9e929a2302655f3964eb64b47f2d80418b46e478f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8410.tmp
MD5
9a09e634a79b22f06eed6f7d7a6a69c4

SHA1
8e810ba28e287b0ae7e36e61b53998d7a07c7671

SHA256
25663795c310178d7e27d499cf13454e1af5afa0c2db59e93e2d563ef2140e15

SHA512
9bc20ed2af7e63df53210e6f532fb698678f1c6e33381217e49d8681013919820b5a328a82d3d3aa75e65afa8e16b5d7218e8f1034f650ddc6b9e57f8efa9422

Download Submit
memory/840-11-0x0000000000000000-mapping.dmp

Download
memory/1068-13-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/1068-14-0x000000000040104C-mapping.dmp

Download
memory/1420-29-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1420-18-0x0000000000000000-mapping.dmp

Download
memory/1420-44-0x00000000067E0000-0x00000000067E1000-memory.dmp

Filesize
4KB

Download
memory/1420-22-0x0000000072CD0000-0x00000000733BE000-memory.dmp

Filesize
6.9MB

Download
memory/1420-38-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/1592-21-0x0000000000000000-mapping.dmp

Download
memory/1680-23-0x0000000000000000-mapping.dmp

Download
memory/1680-48-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/1680-30-0x0000000072CD0000-0x00000000733BE000-memory.dmp

Filesize
6.9MB

Download
memory/1680-35-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1872-26-0x0000000000000000-mapping.dmp

Download
memory/4544-43-0x0000000000000000-mapping.dmp

Download
memory/4668-45-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4668-46-0x0000000000411654-mapping.dmp

Download
memory/4668-47-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4804-8-0x0000000005380000-0x000000000538E000-memory.dmp

Filesize
56KB

Download
memory/4804-2-0x00000000739D0000-0x00000000740BE000-memory.dmp

Filesize
6.9MB

Download
memory/4804-9-0x0000000007AD0000-0x0000000007C92000-memory.dmp

Filesize
1.8MB

Download
memory/4804-3-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4804-5-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/4804-10-0x0000000007D40000-0x0000000007D41000-memory.dmp

Filesize
4KB

Download
memory/4804-7-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/4804-6-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download