agenttesla | 79b272f39153157a41014dd43b6e3aaa9db993e68000963b2f94d1dae03b08b7

General

Target

dar.exe
Size

535KB
MD5

a34f16774efd878af58828fdbfdc9d90
SHA1

022ea1acccd4bd60b2e4155d38af6492728d9d8f
SHA256

e4d8083ef442c5a9a0daa9bdd5e86b685cdd47a1c233f35393df55aba4acddbb
SHA512

4e54b9f48c5f9faa68d97f8d36c5e1a455725fb8a948f4db5cab82a983df5c03ad7486098c0559a3eaffd4fc916d05aee398013769905f7ef461929a45c122f8

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sbrenind.com
Port:
587
Username:
[email protected]
Password:
Wiremoney123.

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/844-64-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/844-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/844-65-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/844-66-0x000000000044736E-mapping.dmp	family_agenttesla
behavioral1/memory/844-68-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/844-70-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

dar.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dar.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dar.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dar.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dar.exe

description pid process target process

PID 852 set thread context of 844 852 dar.exe dar.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1756 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

dar.exedar.exe

pid process

852 dar.exe
844 dar.exe
844 dar.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dar.exedar.exe

description pid process

Token: SeDebugPrivilege 852 dar.exe
Token: SeDebugPrivilege 844 dar.exe

description	pid	process	target process
PID 852 set thread context of 844	852	dar.exe	dar.exe

pid	process
1756	schtasks.exe

pid	process
852	dar.exe
844	dar.exe
844	dar.exe

description	pid	process
Token: SeDebugPrivilege	852	dar.exe
Token: SeDebugPrivilege	844	dar.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

dar.exe

description	pid	process	target process
PID 852 wrote to memory of 1756	852	dar.exe	schtasks.exe
PID 852 wrote to memory of 1756	852	dar.exe	schtasks.exe
PID 852 wrote to memory of 1756	852	dar.exe	schtasks.exe
PID 852 wrote to memory of 1756	852	dar.exe	schtasks.exe
PID 852 wrote to memory of 2004	852	dar.exe	dar.exe
PID 852 wrote to memory of 2004	852	dar.exe	dar.exe
PID 852 wrote to memory of 2004	852	dar.exe	dar.exe
PID 852 wrote to memory of 2004	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe
PID 852 wrote to memory of 844	852	dar.exe	dar.exe

outlook_office_path 1 IoCs

Processes:

dar.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dar.exe

outlook_win_path 1 IoCs

Processes:

dar.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dar.exe

C:\Users\Admin\AppData\Local\Temp\dar.exe
"C:\Users\Admin\AppData\Local\Temp\dar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\neHYJSQZu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC949.tmp"
2⤵
- Creates scheduled task(s)
PID:1756

C:\Users\Admin\AppData\Local\Temp\dar.exe
"{path}"
2⤵
PID:2004

C:\Users\Admin\AppData\Local\Temp\dar.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:844

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC949.tmp
Filesize
1KB

MD5
e7ae36d8eb5f36ada9a50ad6354c91de

SHA1
c910fdbf053719eedac4f099835c702cdbbf0e28

SHA256
a40c8cb8180783e1f7324d2eb6486c61afca3e0fefae204c7ce9974aa807b720

SHA512
706dfd4e74919f60bc40fdaac71d52d2cf4d0fc99a5e57e4bfe991a8f7a3e7044e8c88abb121891582de73db5ebd17fd4366966fdac7c03be8003e8a44d3fd84

Download Submit
memory/844-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/844-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/844-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/844-64-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/844-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/844-66-0x000000000044736E-mapping.dmp

Download
memory/844-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/844-70-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/852-56-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/852-57-0x0000000004DF0000-0x0000000004E44000-memory.dmp

Filesize
336KB

Download
memory/852-55-0x0000000076781000-0x0000000076783000-memory.dmp

Filesize
8KB

Download
memory/852-54-0x0000000001310000-0x000000000139C000-memory.dmp

Filesize
560KB

Download
memory/1756-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads