agenttesla | e6ecdaef474a3ea4407eae99ea219723f686756f42cf6bcff199f34677be8a20

General

Target

swif.exe
Size

440KB
MD5

ceae6fe1fbf29a7edc7e4bdc0fa1e90d
SHA1

0ce8bcf3606890d226454341edd131f025f11d3f
SHA256

e6ecdaef474a3ea4407eae99ea219723f686756f42cf6bcff199f34677be8a20
SHA512

50b3189b566cf32657510e9b67b90c4cc25e1ec107fdb6bf268bc5b333839dc854a8993ebb3f1a8457a80a89234931e09dbf11e20cc1cd4b0fbdcc709a222c0e

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3652-116-0x0000000000400000-0x000000000044B000-memory.dmp	family_agenttesla
behavioral2/memory/3652-117-0x000000000040188B-mapping.dmp	family_agenttesla
behavioral2/memory/3652-118-0x0000000000400000-0x000000000044B000-memory.dmp	family_agenttesla
behavioral2/memory/3652-119-0x0000000000510000-0x000000000065A000-memory.dmp	family_agenttesla
behavioral2/memory/3652-123-0x0000000000510000-0x000000000065A000-memory.dmp	family_agenttesla

Loads dropped DLL 1 IoCs

Processes:

swif.exe

pid process

2696 swif.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2696	swif.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

swif.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swif.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swif.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swif.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

swif.exe

description pid process target process

PID 2696 set thread context of 3652 2696 swif.exe swif.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

swif.exe

pid process

3652 swif.exe
3652 swif.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

swif.exe

description pid process

Token: SeDebugPrivilege 3652 swif.exe

description	pid	process	target process
PID 2696 set thread context of 3652	2696	swif.exe	swif.exe

pid	process
3652	swif.exe
3652	swif.exe

description	pid	process
Token: SeDebugPrivilege	3652	swif.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

swif.exe

description	pid	process	target process
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe
PID 2696 wrote to memory of 3652	2696	swif.exe	swif.exe

outlook_office_path 1 IoCs

Processes:

swif.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swif.exe

outlook_win_path 1 IoCs

Processes:

swif.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swif.exe

C:\Users\Admin\AppData\Local\Temp\swif.exe
"C:\Users\Admin\AppData\Local\Temp\swif.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2696

C:\Users\Admin\AppData\Local\Temp\swif.exe
"C:\Users\Admin\AppData\Local\Temp\swif.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsvD2D2.tmp\apcvw.dll
MD5
d9a3dbd5ccd605e72789888cb1bd1070

SHA1
72d6ea339a1d9d2736d50df39379e5d001fc281a

SHA256
c762e080806c747ed7629a1f870cf413b4bf68e4390899a79c27de90e010b7f2

SHA512
199bce599d749a187157c8692d98fd03fc1f446726b241f3b1f1d3bdf6156095ad767c9b204e6df640484e801120a0befb8e574bd9917e22f39d12b2882f4ef4

Download Submit
memory/3652-116-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3652-117-0x000000000040188B-mapping.dmp

Download
memory/3652-118-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3652-120-0x0000000000510000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download
memory/3652-119-0x0000000000510000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download
memory/3652-121-0x0000000000510000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download
memory/3652-122-0x0000000000510000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download
memory/3652-123-0x0000000000510000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads