agenttesla | 6ccd8409f4a545b9d477c7dbb7cf080c74462409d2c573fe4fe135a49455b0e8

General

Target

INQUIRY No. 280720205467.exe
Size

881KB
MD5

e14854c31e52d5e79f15cbe1f1384639
SHA1

55f684506ce07d0ff89cf4a598b32d70fb1dba52
SHA256

2178c5fd247fa0624e9f703162770d12b8dbb9bc6b875b69a6fe760f08100dda
SHA512

decbd1460c31a2b4c9853fab8634ae6e5cc0c137f02158f2d2c04636689f12589611ac1ad837b63c330510f146378d783064b4893eb0e0bbc43fd1e30fdaf59c

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kohinoorribbon.com
Port:
587
Username:
[email protected]
Password:
ashu@1976

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/580-64-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/580-65-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/580-66-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/580-67-0x0000000000446CBE-mapping.dmp	family_agenttesla
behavioral1/memory/580-69-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/580-71-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

INQUIRY No. 280720205467.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY No. 280720205467.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY No. 280720205467.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY No. 280720205467.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

INQUIRY No. 280720205467.exe

description pid process target process

PID 1228 set thread context of 580 1228 INQUIRY No. 280720205467.exe INQUIRY No. 280720205467.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1176 schtasks.exe

description	pid	process	target process
PID 1228 set thread context of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe

pid	process
1176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

INQUIRY No. 280720205467.exeINQUIRY No. 280720205467.exe

pid	process
1228	INQUIRY No. 280720205467.exe
1228	INQUIRY No. 280720205467.exe
1228	INQUIRY No. 280720205467.exe
1228	INQUIRY No. 280720205467.exe
1228	INQUIRY No. 280720205467.exe
580	INQUIRY No. 280720205467.exe
580	INQUIRY No. 280720205467.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INQUIRY No. 280720205467.exeINQUIRY No. 280720205467.exe

description pid process

Token: SeDebugPrivilege 1228 INQUIRY No. 280720205467.exe
Token: SeDebugPrivilege 580 INQUIRY No. 280720205467.exe

description	pid	process
Token: SeDebugPrivilege	1228	INQUIRY No. 280720205467.exe
Token: SeDebugPrivilege	580	INQUIRY No. 280720205467.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

INQUIRY No. 280720205467.exe

description	pid	process	target process
PID 1228 wrote to memory of 1176	1228	INQUIRY No. 280720205467.exe	schtasks.exe
PID 1228 wrote to memory of 1176	1228	INQUIRY No. 280720205467.exe	schtasks.exe
PID 1228 wrote to memory of 1176	1228	INQUIRY No. 280720205467.exe	schtasks.exe
PID 1228 wrote to memory of 1176	1228	INQUIRY No. 280720205467.exe	schtasks.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe
PID 1228 wrote to memory of 580	1228	INQUIRY No. 280720205467.exe	INQUIRY No. 280720205467.exe

outlook_office_path 1 IoCs

Processes:

INQUIRY No. 280720205467.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY No. 280720205467.exe

outlook_win_path 1 IoCs

Processes:

INQUIRY No. 280720205467.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY No. 280720205467.exe

C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 280720205467.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 280720205467.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KRYrZRar" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9BF2.tmp"
2⤵
- Creates scheduled task(s)
PID:1176

C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 280720205467.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9BF2.tmp

Filesize
1KB

MD5
3b18c310b402995fb157700f1330f994

SHA1
eb0a3efc6848ef46468457673f188c5a0264778e

SHA256
bf551d63e1cfcfb4edc69e7d2b26bd298b570bf6db80904b35b9ddbbe9081546

SHA512
297c5fe773f9d8f2b408de227a29110f297c06a51d391dfaa36ebd0b28df055f88c81e18873ac71102c4e630af9235e94511b53dad2bb01e70e3baa3e40adfb6

Download Submit
memory/580-64-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/580-66-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/580-71-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/580-69-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/580-67-0x0000000000446CBE-mapping.dmp

Download
memory/580-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/580-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/580-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1176-59-0x0000000000000000-mapping.dmp

Download
memory/1228-54-0x0000000000EC0000-0x0000000000FA2000-memory.dmp

Filesize
904KB

Download
memory/1228-55-0x0000000000370000-0x000000000037A000-memory.dmp

Filesize
40KB

Download
memory/1228-56-0x0000000004BB0000-0x0000000004C18000-memory.dmp

Filesize
416KB

Download
memory/1228-58-0x00000000751C1000-0x00000000751C3000-memory.dmp

Filesize
8KB

Download
memory/1228-57-0x0000000000A30000-0x0000000000A7A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads