agenttesla | 5ac197bfb4a9930cd0c353acf03782ec22c8cab25ed1ad601276862b595c08a7

General

Target

Ref_document.js
Size

440KB
MD5

74bdf490ccaf6985754ff0bc74e2f9b9
SHA1

66ace724ff214ba92d9c557c4f3047ae3abcd169
SHA256

5ac197bfb4a9930cd0c353acf03782ec22c8cab25ed1ad601276862b595c08a7
SHA512

143e2eec866f37ccccf3a83f9a75901245b3335f790d6671c6ef5b44ce7f5e5044b6d0e6c02abe08487ba28be34ac6c8b6839e8c3fe374b5be8cb1f6b8e3140d

Score

10^/10

agenttesla vjw0rm collection keylogger persistence spyware stealer suricata trojan worm

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtpout.secureserver.net
Port:
587
Username:
[email protected]
Password:
talific123$

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtpout.secureserver.net
Port:
587
Username:
[email protected]
Password:
talific123$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exe

flow	pid	process
3	4908	wscript.exe
13	4908	wscript.exe
16	4908	wscript.exe
35	4908	wscript.exe
36	4908	wscript.exe
39	4908	wscript.exe
40	4908	wscript.exe
43	4908	wscript.exe
44	4908	wscript.exe
47	4908	wscript.exe
48	4908	wscript.exe
49	4908	wscript.exe
50	4908	wscript.exe
51	4908	wscript.exe
52	4908	wscript.exe
53	4908	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

MEGA NEW BIN.exe

pid process

4912 MEGA NEW BIN.exe

pid	process
4912	MEGA NEW BIN.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KGoOYvDsTU.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KGoOYvDsTU.js	wscript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MEGA NEW BIN.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MEGA NEW BIN.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MEGA NEW BIN.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MEGA NEW BIN.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\KGoOYvDsTU.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MEGA NEW BIN.exe

pid process

4912 MEGA NEW BIN.exe
4912 MEGA NEW BIN.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MEGA NEW BIN.exe

description pid process

Token: SeDebugPrivilege 4912 MEGA NEW BIN.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MEGA NEW BIN.exe

pid process

4912 MEGA NEW BIN.exe

pid	process
4912	MEGA NEW BIN.exe
4912	MEGA NEW BIN.exe

description	pid	process
Token: SeDebugPrivilege	4912	MEGA NEW BIN.exe

pid	process
4912	MEGA NEW BIN.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4832 wrote to memory of 4908	4832	wscript.exe	wscript.exe
PID 4832 wrote to memory of 4908	4832	wscript.exe	wscript.exe
PID 4832 wrote to memory of 4912	4832	wscript.exe	MEGA NEW BIN.exe
PID 4832 wrote to memory of 4912	4832	wscript.exe	MEGA NEW BIN.exe
PID 4832 wrote to memory of 4912	4832	wscript.exe	MEGA NEW BIN.exe

outlook_office_path 1 IoCs

Processes:

MEGA NEW BIN.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MEGA NEW BIN.exe

outlook_win_path 1 IoCs

Processes:

MEGA NEW BIN.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MEGA NEW BIN.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Ref_document.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KGoOYvDsTU.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:4908
- C:\Users\Admin\AppData\Local\Temp\MEGA NEW BIN.exe
  "C:\Users\Admin\AppData\Local\Temp\MEGA NEW BIN.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:4912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MEGA NEW BIN.exe

Filesize
210KB

MD5
2c62d1af397307070b38d477e80eda96

SHA1
a410a471573d275602bc294aa040aa88824a1735

SHA256
f2033e6253ec049c95fe3aec2813ebf036cd5a5f75aa3fd6a04e2d743145613e

SHA512
1995adab468975987268b8551fa970d3f773f9a9141559b149b73b894d26e4865ccb4a303693974f9f7ad2aa3fea26559a19721519c41a0d05676cf32afe4213

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEGA NEW BIN.exe

Filesize
210KB

MD5
2c62d1af397307070b38d477e80eda96

SHA1
a410a471573d275602bc294aa040aa88824a1735

SHA256
f2033e6253ec049c95fe3aec2813ebf036cd5a5f75aa3fd6a04e2d743145613e

SHA512
1995adab468975987268b8551fa970d3f773f9a9141559b149b73b894d26e4865ccb4a303693974f9f7ad2aa3fea26559a19721519c41a0d05676cf32afe4213

Download Submit
C:\Users\Admin\AppData\Roaming\KGoOYvDsTU.js

Filesize
24KB

MD5
de9005cfc1045e7bb33c69f41eefdc4c

SHA1
d0cdb830ac5fc6e9a12f9ec2c95c3dc2863c6546

SHA256
8b773602a44e4a202b24e402f41bea6b2cfa05f00019c58494cfd028cb6c3f2b

SHA512
99621c2edcd175fa11c205b1de52bd88c210d4941896fc6751ae4dcaf718e49bd736c4f339594b2d0218a004dfcfe54f4fee0280afc77dc5a62ea139a822a46b

Download Submit
memory/4908-132-0x0000000000000000-mapping.dmp

Download
memory/4912-134-0x0000000000000000-mapping.dmp

Download
memory/4912-137-0x0000000000620000-0x000000000065A000-memory.dmp

Filesize
232KB

Download
memory/4912-138-0x00000000055F0000-0x0000000005B94000-memory.dmp

Filesize
5.6MB

Download
memory/4912-139-0x0000000005040000-0x00000000050DC000-memory.dmp

Filesize
624KB

Download
memory/4912-140-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Filesize
408KB

Download
memory/4912-141-0x0000000006270000-0x00000000062C0000-memory.dmp

Filesize
320KB

Download
memory/4912-142-0x00000000065D0000-0x0000000006662000-memory.dmp

Filesize
584KB

Download
memory/4912-143-0x0000000006020000-0x000000000602A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads