agenttesla | e3bf1077e2dfc75592d9f064abc7ada64117a2478b23284e172f6cfa95b12484

General

Target

Reciept.exe
Size

531KB
MD5

a1d22134cff1b4aa46c8182a6e53d5ca
SHA1

9873a836becb1c55473cddc412209bc72cbe43fe
SHA256

29e48627a7f173fbbb821c3c136e48909acde6a2c488aec8ecaf7c12ba1df9c5
SHA512

5325dd55fefc9fa95584929fd0e7ed556762dd9b40b3c9f3dface1ef1777c24ec0f9ac3e6ddda5ef569a4910ba29347db7e8f682a59d225342abe8dbbc572706

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.rezuit.pro
Port:
587
Username:
[email protected]
Password:
grace1234

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1984-61-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1984-62-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1984-63-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1984-64-0x000000000045482E-mapping.dmp	family_agenttesla
behavioral1/memory/1984-66-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1984-68-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Reciept.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Reciept.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Reciept.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Reciept.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Reciept.exe

description pid process target process

PID 272 set thread context of 1984 272 Reciept.exe Reciept.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2036 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Reciept.exeReciept.exe

pid process

272 Reciept.exe
272 Reciept.exe
272 Reciept.exe
1984 Reciept.exe
1984 Reciept.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Reciept.exeReciept.exe

description pid process

Token: SeDebugPrivilege 272 Reciept.exe
Token: SeDebugPrivilege 1984 Reciept.exe

description	pid	process	target process
PID 272 set thread context of 1984	272	Reciept.exe	Reciept.exe

pid	process
2036	schtasks.exe

pid	process
272	Reciept.exe
272	Reciept.exe
272	Reciept.exe
1984	Reciept.exe
1984	Reciept.exe

description	pid	process
Token: SeDebugPrivilege	272	Reciept.exe
Token: SeDebugPrivilege	1984	Reciept.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Reciept.exe

description	pid	process	target process
PID 272 wrote to memory of 2036	272	Reciept.exe	schtasks.exe
PID 272 wrote to memory of 2036	272	Reciept.exe	schtasks.exe
PID 272 wrote to memory of 2036	272	Reciept.exe	schtasks.exe
PID 272 wrote to memory of 2036	272	Reciept.exe	schtasks.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe
PID 272 wrote to memory of 1984	272	Reciept.exe	Reciept.exe

outlook_office_path 1 IoCs

Processes:

Reciept.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Reciept.exe

outlook_win_path 1 IoCs

Processes:

Reciept.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Reciept.exe

C:\Users\Admin\AppData\Local\Temp\Reciept.exe
"C:\Users\Admin\AppData\Local\Temp\Reciept.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SIqjwHdo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp90DB.tmp"
2⤵
- Creates scheduled task(s)
PID:2036

C:\Users\Admin\AppData\Local\Temp\Reciept.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp90DB.tmp
Filesize
1KB

MD5
bfef3e1a8f25d05c5bf70338a06283f3

SHA1
b99ac5f3e9245bc0080f92e48a2b013d12841770

SHA256
940c12e348ebb6dd2a4e8ff79bf06e5753894ffa906033c343fdcef3f9986edc

SHA512
e3b0c2e04b4b7747d149c7ffd26a1527ea8d684c173982562bf3501b585a23b8daa77e27a6d4001986dc652a8db08695258ddb9276de059eec896929a7382184

Download Submit
memory/272-55-0x0000000074710000-0x0000000074CBB000-memory.dmp

Filesize
5.7MB

Download
memory/272-54-0x0000000075951000-0x0000000075953000-memory.dmp

Filesize
8KB

Download
memory/1984-61-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-58-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-59-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-62-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-63-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-64-0x000000000045482E-mapping.dmp

Download
memory/1984-66-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-68-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-70-0x0000000074710000-0x0000000074CBB000-memory.dmp

Filesize
5.7MB

Download
memory/2036-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads