agenttesla | 02f546ccde1ea022a6cc1fe79459313fbe60febce49aa33535f51d7308e5ea8e

General

Target

WT0045679.exe
Size

348KB
MD5

62ed509fb1d4970cdce54f932c62f183
SHA1

a9ad23ec52ed7a577cc7e3ae3136b9386b29793c
SHA256

6e5534bae3f5c22467266cc1921253fded33437267b0f8b469bb17282c52a4f2
SHA512

bb72fe936402a70f7b6e7be9d0dfd80011e668a34cdad12b4407c4fa6f1f65e98b5766a2e693172cfbc7a4984910e50d255392b944d4931f73f27ae6ffb0a453

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mexicanproduct.com.mx
Port:
587
Username:
[email protected]
Password:
Produccion2020.

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1716-63-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1716-64-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1716-65-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1716-66-0x000000000044983E-mapping.dmp	family_agenttesla
behavioral1/memory/1716-68-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1716-70-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

WT0045679.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WT0045679.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WT0045679.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WT0045679.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

WT0045679.exe

description pid process target process

PID 736 set thread context of 1716 736 WT0045679.exe WT0045679.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2028 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

WT0045679.exeWT0045679.exe

pid process

736 WT0045679.exe
1716 WT0045679.exe
1716 WT0045679.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WT0045679.exeWT0045679.exe

description pid process

Token: SeDebugPrivilege 736 WT0045679.exe
Token: SeDebugPrivilege 1716 WT0045679.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WT0045679.exe

pid process

1716 WT0045679.exe

description	pid	process	target process
PID 736 set thread context of 1716	736	WT0045679.exe	WT0045679.exe

pid	process
2028	schtasks.exe

pid	process
736	WT0045679.exe
1716	WT0045679.exe
1716	WT0045679.exe

description	pid	process
Token: SeDebugPrivilege	736	WT0045679.exe
Token: SeDebugPrivilege	1716	WT0045679.exe

pid	process
1716	WT0045679.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

WT0045679.exe

description	pid	process	target process
PID 736 wrote to memory of 2028	736	WT0045679.exe	schtasks.exe
PID 736 wrote to memory of 2028	736	WT0045679.exe	schtasks.exe
PID 736 wrote to memory of 2028	736	WT0045679.exe	schtasks.exe
PID 736 wrote to memory of 2028	736	WT0045679.exe	schtasks.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe
PID 736 wrote to memory of 1716	736	WT0045679.exe	WT0045679.exe

outlook_office_path 1 IoCs

Processes:

WT0045679.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WT0045679.exe

outlook_win_path 1 IoCs

Processes:

WT0045679.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WT0045679.exe

C:\Users\Admin\AppData\Local\Temp\WT0045679.exe
"C:\Users\Admin\AppData\Local\Temp\WT0045679.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kSFpxmJtyNcCS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9CDC.tmp"
2⤵
- Creates scheduled task(s)
PID:2028

C:\Users\Admin\AppData\Local\Temp\WT0045679.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9CDC.tmp

Filesize
1KB

MD5
956506514f9f995a0e09a7e322808087

SHA1
11f7dae4fc5fb832c45672728436ee5917a152c3

SHA256
7f506838fa9951cf7d9bcb7c03fc9270cb0ff3b15b06973cccaae9fdcb59a17d

SHA512
47d1afef6570baad1738563a79795323700c482f8f29950cc58589ef6fea1ecaf7aab07e7cafc99d0d894996622b3ffc4c0bc55ece79c1f9054861ebf443ed71

Download Submit
memory/736-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/736-56-0x0000000000410000-0x0000000000418000-memory.dmp

Filesize
32KB

Download
memory/736-57-0x0000000002060000-0x00000000020B6000-memory.dmp

Filesize
344KB

Download
memory/736-54-0x0000000000950000-0x00000000009AE000-memory.dmp

Filesize
376KB

Download
memory/1716-60-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1716-61-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1716-63-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1716-64-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1716-65-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1716-66-0x000000000044983E-mapping.dmp

Download
memory/1716-68-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1716-70-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2028-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads