agenttesla | f0bcd734a22e89790c9b50790f7dc744e5a43bc62427deb99ff955f876309844

General

Target

Tnt_consignment_pickup_Aw(Dstnt_p067b).js

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.zolvtek.com/
Port:
21
Username:
[email protected]
Password:
bird0006

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Internet Explorer.exe	family_agenttesla
C:\Users\Admin\AppData\Roaming\Internet Explorer.exe	family_agenttesla

Blocklisted process makes network request 24 IoCs

Processes:

wscript.exe

flow	pid	process
6	604	wscript.exe
8	604	wscript.exe
11	604	wscript.exe
12	604	wscript.exe
14	604	wscript.exe
15	604	wscript.exe
16	604	wscript.exe
18	604	wscript.exe
19	604	wscript.exe
20	604	wscript.exe
22	604	wscript.exe
23	604	wscript.exe
24	604	wscript.exe
30	604	wscript.exe
31	604	wscript.exe
32	604	wscript.exe
34	604	wscript.exe
35	604	wscript.exe
36	604	wscript.exe
38	604	wscript.exe
39	604	wscript.exe
40	604	wscript.exe
42	604	wscript.exe
43	604	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

Internet Explorer.exe

pid process

368 Internet Explorer.exe

Drops startup file 2 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tnt_consignment_pickup_Aw(Dstnt_p067b).js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tnt_consignment_pickup_Aw(Dstnt_p067b).js	wscript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exeInternet Explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tnt_consignment_pickup_Aw(Dstnt_p067b) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Tnt_consignment_pickup_Aw(Dstnt_p067b).js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tnt_consignment_pickup_Aw(Dstnt_p067b) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Tnt_consignment_pickup_Aw(Dstnt_p067b).js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\File Transfer Protocol = "C:\\Users\\Admin\\AppData\\Roaming\\File Transfer Protocol\\File Transfer Protocol.exe"	Internet Explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tnt_consignment_pickup_Aw(Dstnt_p067b) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Tnt_consignment_pickup_Aw(Dstnt_p067b).js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tnt_consignment_pickup_Aw(Dstnt_p067b) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Tnt_consignment_pickup_Aw(Dstnt_p067b).js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
5	ip-api.com

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E99B2B1-5639-11EB-8489-EE45CAFA0C11} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Internet Explorer.exetaskmgr.exe

pid	process
368	Internet Explorer.exe
368	Internet Explorer.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

652 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Internet Explorer.exeAUDIODG.EXEtaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	368	Internet Explorer.exe
Token: 33	1148	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1148	AUDIODG.EXE
Token: 33	1148	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1148	AUDIODG.EXE
Token: SeDebugPrivilege	652	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exetaskmgr.exe

pid	process
1928	iexplore.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe
652	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1928 iexplore.exe
1928 iexplore.exe
1944 IEXPLORE.EXE
1944 IEXPLORE.EXE
1944 IEXPLORE.EXE
1944 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

wscript.exewscript.exeiexplore.exe

description	pid	process	target process
PID 1408 wrote to memory of 604	1408	wscript.exe	wscript.exe
PID 1408 wrote to memory of 604	1408	wscript.exe	wscript.exe
PID 1408 wrote to memory of 604	1408	wscript.exe	wscript.exe
PID 604 wrote to memory of 368	604	wscript.exe	Internet Explorer.exe
PID 604 wrote to memory of 368	604	wscript.exe	Internet Explorer.exe
PID 604 wrote to memory of 368	604	wscript.exe	Internet Explorer.exe
PID 604 wrote to memory of 368	604	wscript.exe	Internet Explorer.exe
PID 1928 wrote to memory of 1944	1928	iexplore.exe	IEXPLORE.EXE
PID 1928 wrote to memory of 1944	1928	iexplore.exe	IEXPLORE.EXE
PID 1928 wrote to memory of 1944	1928	iexplore.exe	IEXPLORE.EXE
PID 1928 wrote to memory of 1944	1928	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Tnt_consignment_pickup_Aw(Dstnt_p067b).js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Tnt_consignment_pickup_Aw(Dstnt_p067b).js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:604

C:\Users\Admin\AppData\Roaming\Internet Explorer.exe
"C:\Users\Admin\AppData\Roaming\Internet Explorer.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1944

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Internet Explorer.exe
MD5
69968540ca3bc109959e30c6c5c4b746

SHA1
5629ab083b93eb0b929d5918911c4573d3e8cf73

SHA256
4b18321dbf058432c0ae26683c816406771e44cff9fbfcf26e87e6ff1029a35d

SHA512
66d8f565561dc3a8d7c282fe0ff2f2a250d084a64caee5f6f8f8d13b8cf3514a541deb71d88fdcd71d70e66ffe4c851df0f962b4703d8ced9053db0942ac3ed6

Download Submit
C:\Users\Admin\AppData\Roaming\Internet Explorer.exe
MD5
69968540ca3bc109959e30c6c5c4b746

SHA1
5629ab083b93eb0b929d5918911c4573d3e8cf73

SHA256
4b18321dbf058432c0ae26683c816406771e44cff9fbfcf26e87e6ff1029a35d

SHA512
66d8f565561dc3a8d7c282fe0ff2f2a250d084a64caee5f6f8f8d13b8cf3514a541deb71d88fdcd71d70e66ffe4c851df0f962b4703d8ced9053db0942ac3ed6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tnt_consignment_pickup_Aw(Dstnt_p067b).js
MD5
840dc62a11fb14751fe953d7dfcd5574

SHA1
64e0dab4021a7329e032641c9a2d996702e35828

SHA256
f15399a055d4eb34ad03dde34727b9728b55da64abfc14b3f25e7ae5527216b9

SHA512
7a0c68ecbc5692664479ee184251bc25c47fca75dbe2f5f664cd2ed3be1f4a8bea58534bb2fa0c267d55e6082277c66c325f5cbe13fc6f893a5c87a46fe95db5

Download Submit
C:\Users\Admin\AppData\Roaming\Tnt_consignment_pickup_Aw(Dstnt_p067b).js
MD5
840dc62a11fb14751fe953d7dfcd5574

SHA1
64e0dab4021a7329e032641c9a2d996702e35828

SHA256
f15399a055d4eb34ad03dde34727b9728b55da64abfc14b3f25e7ae5527216b9

SHA512
7a0c68ecbc5692664479ee184251bc25c47fca75dbe2f5f664cd2ed3be1f4a8bea58534bb2fa0c267d55e6082277c66c325f5cbe13fc6f893a5c87a46fe95db5

Download Submit
memory/368-6-0x0000000000000000-mapping.dmp

Download
memory/368-9-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/368-11-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/604-2-0x0000000000000000-mapping.dmp

Download
memory/944-10-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp

Filesize
2.5MB

Download
memory/1408-4-0x0000000002630000-0x0000000002634000-memory.dmp

Filesize
16KB

Download
memory/1944-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads