agenttesla | 1bda01f0ea187a42b179d780e45f45e229caecdca515402f781df52bc8ca3420

General

Target

HTG-9066543.exe
Size

708KB
MD5

ffee54880cc41b051b00115466ff6298
SHA1

758745708de2c683045a0bc6f96efad065d463e0
SHA256

1bda01f0ea187a42b179d780e45f45e229caecdca515402f781df52bc8ca3420
SHA512

f21141c723a4dd2ad8549b936d84112f32c6bf6986abb623dde6a1cf3b85437efed45627d82224c23b0902a2e34d695a5ba166d22efc7665157845e5605eb242

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.kpce-co.com
Port:
587
Username:
[email protected]
Password:
g@jnJ{#6Eva5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/744-16-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/744-17-0x00000000009B0000-0x00000000009E6000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

Processes:

ldauib.exeoon80gy9qs.exe

pid process

1704 ldauib.exe
744 oon80gy9qs.exe
Loads dropped DLL 2 IoCs

Processes:

HTG-9066543.exeldauib.exe

pid process

2028 HTG-9066543.exe
1704 ldauib.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

ldauib.exe

description pid process target process

PID 1704 set thread context of 744 1704 ldauib.exe oon80gy9qs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ldauib.exeoon80gy9qs.exe

pid process

1704 ldauib.exe
1704 ldauib.exe
1704 ldauib.exe
1704 ldauib.exe
744 oon80gy9qs.exe
744 oon80gy9qs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ldauib.exe

pid process

1704 ldauib.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

oon80gy9qs.exe

description pid process

Token: SeDebugPrivilege 744 oon80gy9qs.exe

pid	process
1704	ldauib.exe
744	oon80gy9qs.exe

pid	process
2028	HTG-9066543.exe
1704	ldauib.exe

description	pid	process	target process
PID 1704 set thread context of 744	1704	ldauib.exe	oon80gy9qs.exe

pid	process
1704	ldauib.exe
1704	ldauib.exe
1704	ldauib.exe
1704	ldauib.exe
744	oon80gy9qs.exe
744	oon80gy9qs.exe

pid	process
1704	ldauib.exe

description	pid	process
Token: SeDebugPrivilege	744	oon80gy9qs.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

HTG-9066543.exeldauib.exe

description	pid	process	target process
PID 2028 wrote to memory of 1704	2028	HTG-9066543.exe	ldauib.exe
PID 2028 wrote to memory of 1704	2028	HTG-9066543.exe	ldauib.exe
PID 2028 wrote to memory of 1704	2028	HTG-9066543.exe	ldauib.exe
PID 2028 wrote to memory of 1704	2028	HTG-9066543.exe	ldauib.exe
PID 1704 wrote to memory of 744	1704	ldauib.exe	oon80gy9qs.exe
PID 1704 wrote to memory of 744	1704	ldauib.exe	oon80gy9qs.exe
PID 1704 wrote to memory of 744	1704	ldauib.exe	oon80gy9qs.exe
PID 1704 wrote to memory of 744	1704	ldauib.exe	oon80gy9qs.exe
PID 1704 wrote to memory of 744	1704	ldauib.exe	oon80gy9qs.exe

C:\Users\Admin\AppData\Local\Temp\HTG-9066543.exe
"C:\Users\Admin\AppData\Local\Temp\HTG-9066543.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\Nla\ldauib.exe
C:\Users\Admin\AppData\Local\Temp\Nla\ldauib.exe C:\Users\Admin\AppData\Local\Temp\Nla\jcrypgdcu.vsl
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\Nla\oon80gy9qs.exe
C:\Users\Admin\AppData\Local\Temp\Nla\ldauib.exe C:\Users\Admin\AppData\Local\Temp\Nla\jcrypgdcu.vsl
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nla\jcrypgdcu.vsl
MD5
2f411ead5a26a57d896f77114305ca74

SHA1
cf4fefad851560a179420eec04814df5cac4332e

SHA256
78e882f79de1808f8f1d20c671667bcaf7fae6e44d16258204c92306c191c515

SHA512
f9bc99a98cedaf13f65ff40cab7842388289490e483a44d3993cc5914c3a1f68b07114b7a38717f7497f45a9171435bb0083de2964264642abb40334ebb7011a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\ldauib.exe
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\ldauib.exe
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\oon80gy9qs.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\whmnljkmkp.idu
MD5
78619ae8c7646998506018a1b5358f9c

SHA1
98fdd1f20c66c006f726f3eca76ff713071fbf7b

SHA256
f8ad84dd359f6df374fa281c4ba827684e5653474cdf7c8ed0c826695c081983

SHA512
fbdcf40951129237212af7de46c8654950be0896c05287041e936283c347bf82732e53d6f53ffade7828ca28ca142283cf17dedaf769f0f3102ed45ddec1b89c

Download Submit
\Users\Admin\AppData\Local\Temp\Nla\ldauib.exe
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\Nla\oon80gy9qs.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
memory/744-14-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/744-11-0x000000000040188B-mapping.dmp

Download
memory/744-16-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/744-17-0x00000000009B0000-0x00000000009E6000-memory.dmp

Filesize
216KB

Download
memory/744-19-0x0000000004821000-0x0000000004822000-memory.dmp

Filesize
4KB

Download
memory/744-20-0x0000000004822000-0x0000000004823000-memory.dmp

Filesize
4KB

Download
memory/744-21-0x0000000004823000-0x0000000004824000-memory.dmp

Filesize
4KB

Download
memory/744-22-0x0000000004824000-0x0000000004825000-memory.dmp

Filesize
4KB

Download
memory/1704-4-0x0000000000000000-mapping.dmp

Download
memory/1704-15-0x0000000000190000-0x0000000000192000-memory.dmp

Filesize
8KB

Download
memory/2028-2-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing