agenttesla | 07233642c7950281930d250fd04fc125415df3e90f2116c0df97658af8249f09

General

Target

Products description.exe
Size

603KB
MD5

19987543a96c675d45ac4e7212d2f465
SHA1

983555e698609ff5aee11137982545b2281679ec
SHA256

ba4c584519a8fa8a90a906dea86ebe75bb3464190a152467d32ebdefcfc4e643
SHA512

ff1a504fa8af3947a6e6a764b1a15827a24980134522cafbb9b75efe8427d057d8b61ffd511ea5dc69afc51355c5f5b28f27d72fbe5c85576bbc169e89e01e6e

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
JEHOVAH8899

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
JEHOVAH8899

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2504-134-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Products description.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Products description.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Products description.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Products description.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Products description.exe

description pid process target process

PID 400 set thread context of 2504 400 Products description.exe Products description.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4136 400 WerFault.exe Products description.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Products description.exeProducts description.exe

pid process

400 Products description.exe
400 Products description.exe
400 Products description.exe
2504 Products description.exe
2504 Products description.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Products description.exeProducts description.exe

description pid process

Token: SeDebugPrivilege 400 Products description.exe
Token: SeDebugPrivilege 2504 Products description.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Products description.exe

pid process

2504 Products description.exe

description	pid	process	target process
PID 400 set thread context of 2504	400	Products description.exe	Products description.exe

pid	pid_target	process	target process
4136	400	WerFault.exe	Products description.exe

pid	process
400	Products description.exe
400	Products description.exe
400	Products description.exe
2504	Products description.exe
2504	Products description.exe

description	pid	process
Token: SeDebugPrivilege	400	Products description.exe
Token: SeDebugPrivilege	2504	Products description.exe

pid	process
2504	Products description.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Products description.exe

description	pid	process	target process
PID 400 wrote to memory of 2504	400	Products description.exe	Products description.exe
PID 400 wrote to memory of 2504	400	Products description.exe	Products description.exe
PID 400 wrote to memory of 2504	400	Products description.exe	Products description.exe
PID 400 wrote to memory of 2504	400	Products description.exe	Products description.exe
PID 400 wrote to memory of 2504	400	Products description.exe	Products description.exe
PID 400 wrote to memory of 2504	400	Products description.exe	Products description.exe
PID 400 wrote to memory of 2504	400	Products description.exe	Products description.exe
PID 400 wrote to memory of 2504	400	Products description.exe	Products description.exe

outlook_office_path 1 IoCs

Processes:

Products description.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Products description.exe

outlook_win_path 1 IoCs

Processes:

Products description.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Products description.exe

C:\Users\Admin\AppData\Local\Temp\Products description.exe
"C:\Users\Admin\AppData\Local\Temp\Products description.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400

C:\Users\Admin\AppData\Local\Temp\Products description.exe
"C:\Users\Admin\AppData\Local\Temp\Products description.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1284
2⤵
- Program crash
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 400 -ip 400
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-130-0x0000000000690000-0x000000000072A000-memory.dmp

Filesize
616KB

Download
memory/400-131-0x0000000005DB0000-0x0000000006354000-memory.dmp

Filesize
5.6MB

Download
memory/400-132-0x00000000058E0000-0x0000000005972000-memory.dmp

Filesize
584KB

Download
memory/2504-133-0x0000000000000000-mapping.dmp

Download
memory/2504-134-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2504-135-0x0000000005430000-0x00000000054CC000-memory.dmp

Filesize
624KB

Download
memory/2504-136-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/2504-137-0x0000000006750000-0x00000000067A0000-memory.dmp

Filesize
320KB

Download
memory/2504-138-0x0000000006BA0000-0x0000000006BAA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads