agenttesla | 5f3ae1dc435ebdcc054f21afe4987b4db5b00e2ac8e9b89d9b447e60d9fbe553

General

Target

AWB#5421457894.exe
Size

676KB
MD5

fb20529923ea7480ca21d00fce76c327
SHA1

46dada6d2eda24b9d9baa954dcad8860a8848126
SHA256

c01176f8ccb757f80cb32c809cfe0ceec9e100b199d4beec5f92adb824517869
SHA512

be795350060e13318700330966fc710d954fb58be47b2654ceb8a19cce251ac539e3d6e6549a4e25835f2e43c33b62cfefbcda6ddbadff6a337d571c744096ed

Score

10^/10

agenttesla agilenet collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
babakings32

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-62-0x0000000000080000-0x00000000000CA000-memory.dmp	family_agenttesla
behavioral1/memory/2032-63-0x0000000000080000-0x00000000000CA000-memory.dmp	family_agenttesla
behavioral1/memory/2032-65-0x0000000000445B0E-mapping.dmp	family_agenttesla
behavioral1/memory/2032-67-0x0000000000080000-0x00000000000CA000-memory.dmp	family_agenttesla
behavioral1/memory/2032-68-0x0000000000080000-0x00000000000CA000-memory.dmp	family_agenttesla
behavioral1/memory/2032-72-0x0000000000080000-0x00000000000CA000-memory.dmp	family_agenttesla
behavioral1/memory/2032-75-0x0000000000080000-0x00000000000CA000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

2032 AddInProcess32.exe
Loads dropped DLL 1 IoCs

Processes:

AWB#5421457894.exe

pid process

1100 AWB#5421457894.exe

pid	process
2032	AddInProcess32.exe

pid	process
1100	AWB#5421457894.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1100-56-0x0000000000330000-0x000000000033A000-memory.dmp	agile_net

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AddInProcess32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ITIXsa = "C:\\Users\\Admin\\AppData\\Roaming\\ITIXsa\\ITIXsa.exe"	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

AWB#5421457894.exe

description pid process target process

PID 1100 set thread context of 2032 1100 AWB#5421457894.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

AWB#5421457894.exeAddInProcess32.exe

pid process

1100 AWB#5421457894.exe
1100 AWB#5421457894.exe
1100 AWB#5421457894.exe
2032 AddInProcess32.exe
2032 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AWB#5421457894.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 1100 AWB#5421457894.exe
Token: SeDebugPrivilege 2032 AddInProcess32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AddInProcess32.exe

pid process

2032 AddInProcess32.exe

description	pid	process	target process
PID 1100 set thread context of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe

pid	process
1100	AWB#5421457894.exe
1100	AWB#5421457894.exe
1100	AWB#5421457894.exe
2032	AddInProcess32.exe
2032	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	1100	AWB#5421457894.exe
Token: SeDebugPrivilege	2032	AddInProcess32.exe

pid	process
2032	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

AWB#5421457894.exe

description	pid	process	target process
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe
PID 1100 wrote to memory of 2032	1100	AWB#5421457894.exe	AddInProcess32.exe

outlook_office_path 1 IoCs

Processes:

AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

Processes:

AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\AWB#5421457894.exe
"C:\Users\Admin\AppData\Local\Temp\AWB#5421457894.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

Filesize
41KB

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

Filesize
41KB

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

Filesize
41KB

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
memory/1100-56-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/1100-54-0x0000000001120000-0x00000000011D0000-memory.dmp

Filesize
704KB

Download
memory/1100-55-0x00000000002F0000-0x000000000030E000-memory.dmp

Filesize
120KB

Download
memory/1100-57-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/2032-60-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2032-63-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2032-65-0x0000000000445B0E-mapping.dmp

Download
memory/2032-67-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2032-68-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2032-62-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2032-72-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2032-75-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2032-59-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2032-77-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads