agenttesla | 6763318edf42d31cf69d2bd88924a66eb1e0722b5986357a8b62d751f0abbb1f

General

Target
Wrongly dated Invoice.exe
Size 882KB
Sample220413-t7ncysdfb6
SHA256 6763318edf42d31cf69d2bd88924a66eb1e0722b5986357a8b62d751f0abbb1f
MD5 56f851214d03ba716c0437e2eb95bf69
SHA1 63919d003f36cb5c5676ce1cddec708c0783bf80
SHA512 65aebd5d0f016a461d2b994787329bbad0a3e5857e2c9341340ca4330892ce9efdc3eb3a1ec30b4e9572f6b40bd51c7a8c338fe8dde68a47c3eaba4d6fe9eace
MD5 SHA1 SHA512

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.mpr4u.my
Port
587
Username
[email protected]
Password
mpr.kisb123456

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.mpr4u.my
Port
587
Username
[email protected]
Password
mpr.kisb123456
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wrongly dated Invoice.exe
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wrongly dated Invoice.exe
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wrongly dated Invoice.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 4144	4652	Wrongly dated Invoice.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4144	Wrongly dated Invoice.exe
4144	Wrongly dated Invoice.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	Wrongly dated Invoice.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4144	Wrongly dated Invoice.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4144	4652	Wrongly dated Invoice.exe	85
PID 4652 wrote to memory of 4144	4652	Wrongly dated Invoice.exe	85
PID 4652 wrote to memory of 4144	4652	Wrongly dated Invoice.exe	85
PID 4652 wrote to memory of 4144	4652	Wrongly dated Invoice.exe	85
PID 4652 wrote to memory of 4144	4652	Wrongly dated Invoice.exe	85
PID 4652 wrote to memory of 4144	4652	Wrongly dated Invoice.exe	85
PID 4652 wrote to memory of 4144	4652	Wrongly dated Invoice.exe	85
PID 4652 wrote to memory of 4144	4652	Wrongly dated Invoice.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wrongly dated Invoice.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wrongly dated Invoice.exe

C:\Users\Admin\AppData\Local\Temp\Wrongly dated Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Wrongly dated Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\Wrongly dated Invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\Wrongly dated Invoice.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:4144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wrongly dated Invoice.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wrongly dated Invoice.exe.log
Size 1KB
SHA256 8d7143472e7cf3a40f46c6346251661e10fe3a932321cff14190648ee3d9c02f
MD5 3aea5c16a0e7b995983bd1771d5ea11d
SHA1 5ce845c82ace7946cec271a8bac45572b977419c
SHA512 4d0949cc3c0b7bc19b94a7166fb1a528c5833773b4b577f1730c4aab93ec03f3d72714ebf8a103f2a6ab4f97abef2945e78c91d464885fb4f1f9c584d7a1b243
MD5 SHA1 SHA512

Submit Download

memory/4144-131-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/4144-133-0x0000000006200000-0x0000000006250000-memory.dmp

Download

memory/4652-124-0x00000000009E0000-0x0000000000AC2000-memory.dmp

Download

memory/4652-125-0x0000000005910000-0x0000000005EB4000-memory.dmp

Download

memory/4652-126-0x0000000005460000-0x00000000054F2000-memory.dmp

Download

memory/4652-127-0x00000000055A0000-0x000000000563C000-memory.dmp

Download

memory/4652-128-0x0000000005510000-0x000000000551A000-memory.dmp

Download

memory/4652-129-0x00000000078E0000-0x0000000007946000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads