agenttesla | f5975138fbd005ad1399f0f2623cff56d494f138a207156e272c85e6e3e77445

General

Target

Swift Copy.exe
Size

640KB
MD5

b772387208e2bc581bd9758fcf1399ab
SHA1

a3159e22c2c3e447f9f025d4cb34afd54cb4bc5e
SHA256

f5975138fbd005ad1399f0f2623cff56d494f138a207156e272c85e6e3e77445
SHA512

a12ce9107c2dd6f6fd1b87657112eccbd374a0a2302984f54ec30e215adc9956d806814562fe678f8a129cb4393a69bb2455c1de16b7f66ed518348bfc912f46

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.rettberrg.com
Port:
587
Username:
ebuk@rettberrg.com
Password:
ka*g((D8

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4368-124-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/4368-125-0x0000000000436C3E-mapping.dmp	family_agenttesla
behavioral2/memory/4368-130-0x0000000004DF0000-0x00000000052EE000-memory.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Swift Copy.exe

description pid process target process

PID 3316 set thread context of 4368 3316 Swift Copy.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Swift Copy.exeMSBuild.exe

pid process

3316 Swift Copy.exe
3316 Swift Copy.exe
4368 MSBuild.exe
4368 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Swift Copy.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 3316 Swift Copy.exe
Token: SeDebugPrivilege 4368 MSBuild.exe

description	pid	process	target process
PID 3316 set thread context of 4368	3316	Swift Copy.exe	MSBuild.exe

pid	process
3316	Swift Copy.exe
3316	Swift Copy.exe
4368	MSBuild.exe
4368	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3316	Swift Copy.exe
Token: SeDebugPrivilege	4368	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Swift Copy.exe

description	pid	process	target process
PID 3316 wrote to memory of 4368	3316	Swift Copy.exe	MSBuild.exe
PID 3316 wrote to memory of 4368	3316	Swift Copy.exe	MSBuild.exe
PID 3316 wrote to memory of 4368	3316	Swift Copy.exe	MSBuild.exe
PID 3316 wrote to memory of 4368	3316	Swift Copy.exe	MSBuild.exe
PID 3316 wrote to memory of 4368	3316	Swift Copy.exe	MSBuild.exe
PID 3316 wrote to memory of 4368	3316	Swift Copy.exe	MSBuild.exe
PID 3316 wrote to memory of 4368	3316	Swift Copy.exe	MSBuild.exe
PID 3316 wrote to memory of 4368	3316	Swift Copy.exe	MSBuild.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3316-115-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/3316-117-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/3316-118-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/3316-119-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/3316-120-0x0000000004B80000-0x0000000004C12000-memory.dmp

Filesize
584KB

Download
memory/3316-121-0x0000000004E80000-0x0000000004E85000-memory.dmp

Filesize
20KB

Download
memory/3316-122-0x0000000007360000-0x0000000007361000-memory.dmp

Filesize
4KB

Download
memory/3316-123-0x0000000007500000-0x000000000757E000-memory.dmp

Filesize
504KB

Download
memory/4368-124-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4368-125-0x0000000000436C3E-mapping.dmp

Download
memory/4368-130-0x0000000004DF0000-0x00000000052EE000-memory.dmp

Filesize
5.0MB

Download
memory/4368-131-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/4368-132-0x0000000005B50000-0x0000000005B51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads