agenttesla | 5e45717983c3908c361d3bfef012f81475c650e01457e1a60f1d9a82eeef67fd

General

Target

OC_0059284716.exe
Size

732KB
MD5

6511a18961fcd77ae02999e152c1fd89
SHA1

44121e716b0d40f6f7b4d683b860c6c7fcf17a40
SHA256

380e7e3441bb952722dded5a8d87c79257ed78dff7d6f9bcab307428b4200578
SHA512

bf7c4881624ea36ed8147e6d7f6ecff87bd6b72bbb3fe13fbe0a5b5c12f39477c852017ccf806bafdf4784bf0cebd88d495a244f509c5789c2198dc72ddeb75e

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
web2.changeip.com
Port:
587
Username:
[email protected]
Password:
6q]Xy%b8?AM~

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
web2.changeip.com
Port:
587
Username:
[email protected]
Password:
6q]Xy%b8?AM~

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/824-138-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OC_0059284716.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	OC_0059284716.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

OC_0059284716.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OC_0059284716.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OC_0059284716.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OC_0059284716.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

OC_0059284716.exe

description pid process target process

PID 3036 set thread context of 824 3036 OC_0059284716.exe OC_0059284716.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4048 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

OC_0059284716.exe

pid process

824 OC_0059284716.exe
824 OC_0059284716.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

OC_0059284716.exe

description pid process

Token: SeDebugPrivilege 824 OC_0059284716.exe

description	pid	process	target process
PID 3036 set thread context of 824	3036	OC_0059284716.exe	OC_0059284716.exe

pid	process
4048	schtasks.exe

pid	process
824	OC_0059284716.exe
824	OC_0059284716.exe

description	pid	process
Token: SeDebugPrivilege	824	OC_0059284716.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

OC_0059284716.exe

description	pid	process	target process
PID 3036 wrote to memory of 4048	3036	OC_0059284716.exe	schtasks.exe
PID 3036 wrote to memory of 4048	3036	OC_0059284716.exe	schtasks.exe
PID 3036 wrote to memory of 4048	3036	OC_0059284716.exe	schtasks.exe
PID 3036 wrote to memory of 824	3036	OC_0059284716.exe	OC_0059284716.exe
PID 3036 wrote to memory of 824	3036	OC_0059284716.exe	OC_0059284716.exe
PID 3036 wrote to memory of 824	3036	OC_0059284716.exe	OC_0059284716.exe
PID 3036 wrote to memory of 824	3036	OC_0059284716.exe	OC_0059284716.exe
PID 3036 wrote to memory of 824	3036	OC_0059284716.exe	OC_0059284716.exe
PID 3036 wrote to memory of 824	3036	OC_0059284716.exe	OC_0059284716.exe
PID 3036 wrote to memory of 824	3036	OC_0059284716.exe	OC_0059284716.exe
PID 3036 wrote to memory of 824	3036	OC_0059284716.exe	OC_0059284716.exe

outlook_office_path 1 IoCs

Processes:

OC_0059284716.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OC_0059284716.exe

outlook_win_path 1 IoCs

Processes:

OC_0059284716.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OC_0059284716.exe

C:\Users\Admin\AppData\Local\Temp\OC_0059284716.exe
"C:\Users\Admin\AppData\Local\Temp\OC_0059284716.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GTXkcWVCImLc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4546.tmp"
2⤵
- Creates scheduled task(s)
PID:4048

C:\Users\Admin\AppData\Local\Temp\OC_0059284716.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OC_0059284716.exe.log

Filesize
685B

MD5
05bdd1f220197301f9a03d67595ac7db

SHA1
3fadb2b5770061249ef30552e38e84d2f685e55b

SHA256
72003e1b55ec4ffea8ee1af0f6df49a63ca557165ca3377a114c2e60af181926

SHA512
915f3f1fda5718ff8a8a26cacd8a88bd5ff46edfc40d807cb5860c21e966523d82cadcaaf79240e6d42fcba8335ef0e6bdd05d8d2210cf4d1ed3e4a71fec6d78

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4546.tmp

Filesize
1KB

MD5
f1c391019dbd22a5af2bec6640f07a2b

SHA1
125bb7acff820bce2720d81ed7236b290b8aa2a7

SHA256
3cca4a81d8feadffff0752f3e4edb9f48713ba18edb68239913d1a1aaed2e65e

SHA512
cb0b880c35b505938781e52e2ddb779dc606daf7afbb97b704e05b2159c2afc8a77dae040e8bf9ce1884ac42f33262e475fff537aa3a348821eaa922ff28ad6a

Download Submit
memory/824-137-0x0000000000000000-mapping.dmp

Download
memory/824-138-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/824-140-0x0000000006710000-0x0000000006776000-memory.dmp

Filesize
408KB

Download
memory/824-141-0x0000000006C20000-0x0000000006C70000-memory.dmp

Filesize
320KB

Download
memory/3036-130-0x0000000000350000-0x000000000040E000-memory.dmp

Filesize
760KB

Download
memory/3036-131-0x0000000005280000-0x0000000005824000-memory.dmp

Filesize
5.6MB

Download
memory/3036-132-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/3036-133-0x00000000059C0000-0x0000000005B46000-memory.dmp

Filesize
1.5MB

Download
memory/3036-134-0x00000000058D0000-0x000000000596C000-memory.dmp

Filesize
624KB

Download
memory/4048-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads