agenttesla | 476723b94746037cf4b29a03167fe89d15a65ac090cc04ca4a0643ff47d31023

General

Target

PO10007986.exe
Size

714KB
MD5

e8975481528a738ad90dfb17f18ab9d6
SHA1

886051a6c3c292f1fcb0dc37496eab10ed57c865
SHA256

77a1ede94526537eaafb97d3988163df0f3cd6887d762faa2db61e49bdeefc02
SHA512

4157640c3749bf81ede2e96437af10d43e5d9b79ab1b838fe170ebcd185f1dcf2c23b3523834f0f55e5dda752f70d246d445e15ed9f4bb2f969046f1c26364ef

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.malkocbebe.com
Port:
587
Username:
[email protected]
Password:
Malkoc2020*

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/944-61-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/944-62-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/944-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/944-64-0x000000000044722E-mapping.dmp	family_agenttesla
behavioral1/memory/944-66-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/944-68-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

PO10007986.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO10007986.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO10007986.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO10007986.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO10007986.exe

description pid process target process

PID 1828 set thread context of 944 1828 PO10007986.exe PO10007986.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

956 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

PO10007986.exePO10007986.exe

pid process

1828 PO10007986.exe
1828 PO10007986.exe
1828 PO10007986.exe
1828 PO10007986.exe
944 PO10007986.exe
944 PO10007986.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO10007986.exePO10007986.exe

description pid process

Token: SeDebugPrivilege 1828 PO10007986.exe
Token: SeDebugPrivilege 944 PO10007986.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PO10007986.exe

pid process

944 PO10007986.exe

description	pid	process	target process
PID 1828 set thread context of 944	1828	PO10007986.exe	PO10007986.exe

pid	process
956	schtasks.exe

pid	process
1828	PO10007986.exe
1828	PO10007986.exe
1828	PO10007986.exe
1828	PO10007986.exe
944	PO10007986.exe
944	PO10007986.exe

description	pid	process
Token: SeDebugPrivilege	1828	PO10007986.exe
Token: SeDebugPrivilege	944	PO10007986.exe

pid	process
944	PO10007986.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PO10007986.exe

description	pid	process	target process
PID 1828 wrote to memory of 956	1828	PO10007986.exe	schtasks.exe
PID 1828 wrote to memory of 956	1828	PO10007986.exe	schtasks.exe
PID 1828 wrote to memory of 956	1828	PO10007986.exe	schtasks.exe
PID 1828 wrote to memory of 956	1828	PO10007986.exe	schtasks.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe
PID 1828 wrote to memory of 944	1828	PO10007986.exe	PO10007986.exe

outlook_office_path 1 IoCs

Processes:

PO10007986.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO10007986.exe

outlook_win_path 1 IoCs

Processes:

PO10007986.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO10007986.exe

C:\Users\Admin\AppData\Local\Temp\PO10007986.exe
"C:\Users\Admin\AppData\Local\Temp\PO10007986.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zKxRUWZXnCauW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE004.tmp"
2⤵
- Creates scheduled task(s)
PID:956

C:\Users\Admin\AppData\Local\Temp\PO10007986.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:944

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE004.tmp
Filesize
1KB

MD5
340cc9aeddd53d140d22860432f01d84

SHA1
63344297b3850a26459baf980e68de9b4ef954e0

SHA256
f993507c604d05ade7431ba9f42dbbf83aa87033a2a82e03dc429ce60337640b

SHA512
4bc832bff2e4f6ca6e2c98bc10b3e0096617221cc4ae60b915dcc339f925e7d73031b552b6c062d941fb7985bf8244c00dc530c887cc490408a38dd13625641c

Download Submit
memory/944-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-64-0x000000000044722E-mapping.dmp

Download
memory/944-66-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/944-70-0x0000000074650000-0x0000000074BFB000-memory.dmp

Filesize
5.7MB

Download
memory/956-56-0x0000000000000000-mapping.dmp

Download
memory/1828-55-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1828-54-0x0000000075741000-0x0000000075743000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads