agenttesla | c62943499b7fed80bf4e37ab525b622ef4fb7cc6b82ddb7b8d6fe75dabcaf363

General

Target

000000090000-0990.exe
Size

1.5MB
MD5

dca3732857d10782f68df4c3e1b757a9
SHA1

95a0c95fee10a8e37fb0bcabff6e4b10924285d2
SHA256

c62943499b7fed80bf4e37ab525b622ef4fb7cc6b82ddb7b8d6fe75dabcaf363
SHA512

5ada13a7e67d59e38d57fccddac36cad71d2ccfff45945cc1274d310ecf4a79f756e865526a1d9d672d6200d0ae4215e5b7754b0b29e88debb5f9db873154ea0

Score

10^/10

agenttesla matiex snakekeylogger keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
srvc13.turhost.com
Port:
587
Username:
[email protected]
Password:
italik2015

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
srvc13.turhost.com
Port:
587
Username:
[email protected]
Password:
italik2015

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
srvc13.turhost.com
Port:
587
Username:
[email protected]
Password:
italik2015

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
srvc13.turhost.com
Port:
587
Username:
[email protected]
Password:
italik2015

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1096-7-0x0000000000400000-0x000000000050C000-memory.dmp	family_matiex
C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe	family_matiex
C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe	family_matiex

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1096-7-0x0000000000400000-0x000000000050C000-memory.dmp	family_snakekeylogger
C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe	family_snakekeylogger
C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe	family_snakekeylogger

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1096-7-0x0000000000400000-0x000000000050C000-memory.dmp	family_agenttesla
C:\Users\Admin\AppData\Local\Temp\4.0.exe	family_agenttesla
C:\Users\Admin\AppData\Local\Temp\4.0.exe	family_agenttesla

Executes dropped EXE 3 IoCs

Processes:

4.0.exebilgi snake 2021.exeMATIEX GODISOD 4.0 .exe

pid process

2016 4.0.exe
3772 bilgi snake 2021.exe
2752 MATIEX GODISOD 4.0 .exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

27 api.ipify.org
6 checkip.dyndns.org
11 freegeoip.app
12 freegeoip.app
13 freegeoip.app
26 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

000000090000-0990.exe

description pid process target process

PID 1048 set thread context of 1096 1048 000000090000-0990.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1192 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

bilgi snake 2021.exe4.0.exeMATIEX GODISOD 4.0 .exe

pid process

3772 bilgi snake 2021.exe
2016 4.0.exe
2016 4.0.exe
2752 MATIEX GODISOD 4.0 .exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

000000090000-0990.exe

pid process

1048 000000090000-0990.exe

pid	process
2016	4.0.exe
3772	bilgi snake 2021.exe
2752	MATIEX GODISOD 4.0 .exe

flow	ioc
27	api.ipify.org
6	checkip.dyndns.org
11	freegeoip.app
12	freegeoip.app
13	freegeoip.app
26	api.ipify.org

description	pid	process	target process
PID 1048 set thread context of 1096	1048	000000090000-0990.exe	MSBuild.exe

pid	process
1192	schtasks.exe

pid	process
3772	bilgi snake 2021.exe
2016	4.0.exe
2016	4.0.exe
2752	MATIEX GODISOD 4.0 .exe

pid	process
1048	000000090000-0990.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bilgi snake 2021.exe4.0.exeMATIEX GODISOD 4.0 .exe

description	pid	process
Token: SeDebugPrivilege	3772	bilgi snake 2021.exe
Token: SeDebugPrivilege	2016	4.0.exe
Token: SeDebugPrivilege	2752	MATIEX GODISOD 4.0 .exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

1096 MSBuild.exe

pid	process
1096	MSBuild.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

000000090000-0990.execmd.exeMSBuild.exeMATIEX GODISOD 4.0 .exe

description	pid	process	target process
PID 1048 wrote to memory of 2912	1048	000000090000-0990.exe	cmd.exe
PID 1048 wrote to memory of 2912	1048	000000090000-0990.exe	cmd.exe
PID 1048 wrote to memory of 2912	1048	000000090000-0990.exe	cmd.exe
PID 1048 wrote to memory of 1096	1048	000000090000-0990.exe	MSBuild.exe
PID 1048 wrote to memory of 1096	1048	000000090000-0990.exe	MSBuild.exe
PID 1048 wrote to memory of 1096	1048	000000090000-0990.exe	MSBuild.exe
PID 1048 wrote to memory of 1096	1048	000000090000-0990.exe	MSBuild.exe
PID 2912 wrote to memory of 1192	2912	cmd.exe	schtasks.exe
PID 2912 wrote to memory of 1192	2912	cmd.exe	schtasks.exe
PID 2912 wrote to memory of 1192	2912	cmd.exe	schtasks.exe
PID 1096 wrote to memory of 2016	1096	MSBuild.exe	4.0.exe
PID 1096 wrote to memory of 2016	1096	MSBuild.exe	4.0.exe
PID 1096 wrote to memory of 2016	1096	MSBuild.exe	4.0.exe
PID 1096 wrote to memory of 3772	1096	MSBuild.exe	bilgi snake 2021.exe
PID 1096 wrote to memory of 3772	1096	MSBuild.exe	bilgi snake 2021.exe
PID 1096 wrote to memory of 3772	1096	MSBuild.exe	bilgi snake 2021.exe
PID 1096 wrote to memory of 2752	1096	MSBuild.exe	MATIEX GODISOD 4.0 .exe
PID 1096 wrote to memory of 2752	1096	MSBuild.exe	MATIEX GODISOD 4.0 .exe
PID 1096 wrote to memory of 2752	1096	MSBuild.exe	MATIEX GODISOD 4.0 .exe
PID 2752 wrote to memory of 3736	2752	MATIEX GODISOD 4.0 .exe	netsh.exe
PID 2752 wrote to memory of 3736	2752	MATIEX GODISOD 4.0 .exe	netsh.exe
PID 2752 wrote to memory of 3736	2752	MATIEX GODISOD 4.0 .exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe
"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xml"
2⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xml"
3⤵
- Creates scheduled task(s)
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\4.0.exe
"C:\Users\Admin\AppData\Local\Temp\4.0.exe" 0
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe
"C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe" 0
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe
"C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe" 0
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
4⤵
PID:3736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xml
MD5
a36564afc14b3eb0849c01a3afdb9944

SHA1
4dcee9fae3fde4e46b08529bc0ba067150686f07

SHA256
9d4342f763c5d62a06f69aa6fdcb1caa376ff2f2c0972f36b487f73b4d221996

SHA512
782082aa36ae056734e90fc079c813dfef59420571a1b70cde4cf15eb6c870f85b2bfe0748ef4db9df3d010c08671bff744d78178ba75bf2ba02b665f044ae89

Download Submit
C:\Users\Admin\AppData\Local\Temp\4.0.exe
MD5
bd5fe63e3666a489e7a221647f6f3807

SHA1
52a8db03aa3db1b9a287688afeffa9f041c3811c

SHA256
5a46b373a0a0894870f5a63e52477dbe71e78efe35aa373c30d2edbdf3e35f9e

SHA512
631a0ce258d4ae4ab81ca69ff344eb8733e5507b4f88c27f8b7491bed8fe2362f944bbdff51abf3089c03a67149a102cce8989d985e60a9531b77a7f260b90e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4.0.exe
MD5
bd5fe63e3666a489e7a221647f6f3807

SHA1
52a8db03aa3db1b9a287688afeffa9f041c3811c

SHA256
5a46b373a0a0894870f5a63e52477dbe71e78efe35aa373c30d2edbdf3e35f9e

SHA512
631a0ce258d4ae4ab81ca69ff344eb8733e5507b4f88c27f8b7491bed8fe2362f944bbdff51abf3089c03a67149a102cce8989d985e60a9531b77a7f260b90e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe
MD5
f615aa95251fc14492843942a588614c

SHA1
296669e81c271762d5068f8a9ecbb354ffc335c9

SHA256
e0b3bd3f2fadd3ef560c7dc1c13e1f50351e8df61139eb8e6367badf7689e71b

SHA512
ad58e4b52132a0c186ff14040bf95cc1c8d65b307c90a6004e1d58e365c91635d998e3259cb5575c79aeb0aed08dd55a827edadfbef7f0ecfbc500dd9b42b6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe
MD5
f615aa95251fc14492843942a588614c

SHA1
296669e81c271762d5068f8a9ecbb354ffc335c9

SHA256
e0b3bd3f2fadd3ef560c7dc1c13e1f50351e8df61139eb8e6367badf7689e71b

SHA512
ad58e4b52132a0c186ff14040bf95cc1c8d65b307c90a6004e1d58e365c91635d998e3259cb5575c79aeb0aed08dd55a827edadfbef7f0ecfbc500dd9b42b6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe
MD5
e33e63bda6a3976ecadfa9ee6f096944

SHA1
68b683bb325ae9c21f471593f007c797a02dc497

SHA256
c2d3a6b20eb4bc377bf9be955b23615492786be0613373bfc7f440ab872a8142

SHA512
91b672e86e30804e7e632d79e78c99ac9a0ee7c8468ad9eecc555f15773bb535d430f0c39efa61d9afdec7bb3f05f97cd18126e6c16eb6b1036e131b8f256142

Download Submit
C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe
MD5
e33e63bda6a3976ecadfa9ee6f096944

SHA1
68b683bb325ae9c21f471593f007c797a02dc497

SHA256
c2d3a6b20eb4bc377bf9be955b23615492786be0613373bfc7f440ab872a8142

SHA512
91b672e86e30804e7e632d79e78c99ac9a0ee7c8468ad9eecc555f15773bb535d430f0c39efa61d9afdec7bb3f05f97cd18126e6c16eb6b1036e131b8f256142

Download Submit
memory/1096-7-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/1096-3-0x000000000040104C-mapping.dmp

Download
memory/1192-4-0x0000000000000000-mapping.dmp

Download
memory/2016-48-0x0000000005841000-0x0000000005842000-memory.dmp

Filesize
4KB

Download
memory/2016-9-0x0000000000000000-mapping.dmp

Download
memory/2016-22-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/2016-44-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/2016-34-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/2016-28-0x0000000005E10000-0x0000000005E11000-memory.dmp

Filesize
4KB

Download
memory/2016-19-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-35-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/2752-15-0x0000000000000000-mapping.dmp

Download
memory/2752-21-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2752-27-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/2752-18-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-33-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/2912-2-0x0000000000000000-mapping.dmp

Download
memory/3736-40-0x0000000000000000-mapping.dmp

Download
memory/3772-23-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/3772-36-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/3772-37-0x0000000006920000-0x0000000006921000-memory.dmp

Filesize
4KB

Download
memory/3772-38-0x00000000067F0000-0x00000000067F1000-memory.dmp

Filesize
4KB

Download
memory/3772-39-0x0000000006790000-0x0000000006791000-memory.dmp

Filesize
4KB

Download
memory/3772-20-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/3772-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads