agenttesla | b4629fb4d969ce71bc3e0f8725243ed55f592a944a9ab43044e857d896dee871

General

Target

New Email Added and Messages Alert.js
Size

508KB
MD5

0a74331331f9118783c14a258df23047
SHA1

bfc2ad650dcf6271a07f6eb5ce3efe82b87b7c38
SHA256

b4629fb4d969ce71bc3e0f8725243ed55f592a944a9ab43044e857d896dee871
SHA512

516f8d65e05b581b9262945ef9b8d69bd09319c3768d65ac5b7dda3c065722eba63c5baaa48a9214b724764cf03447235c301025a8b815eb3d80d080be55adc6

Score

10^/10

agenttesla vjw0rm collection keylogger persistence spyware stealer suricata trojan worm

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
files.000webhost.com
Port:
21
Username:
zincox
Password:
computer@1010

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://files.000webhost.com/
Port:
21
Username:
zincox
Password:
computer@1010

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
suricata: ET MALWARE AgentTesla Exfil via FTP
suricata: ET MALWARE AgentTesla Exfil via FTP
suricata

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exe

flow	pid	process
4	1812	wscript.exe
8	1812	wscript.exe
9	1812	wscript.exe
11	1812	wscript.exe
13	1812	wscript.exe
14	1812	wscript.exe
16	1812	wscript.exe
17	1812	wscript.exe
18	1812	wscript.exe
20	1812	wscript.exe
21	1812	wscript.exe
22	1812	wscript.exe
24	1812	wscript.exe
25	1812	wscript.exe
26	1812	wscript.exe
28	1812	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

New Email Added and Messages Alert.exe

pid process

1284 New Email Added and Messages Alert.exe

pid	process
1284	New Email Added and Messages Alert.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezqHzyDEBJ.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezqHzyDEBJ.js	wscript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

New Email Added and Messages Alert.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New Email Added and Messages Alert.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New Email Added and Messages Alert.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New Email Added and Messages Alert.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\ezqHzyDEBJ.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

New Email Added and Messages Alert.exe

pid process

1284 New Email Added and Messages Alert.exe
1284 New Email Added and Messages Alert.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

New Email Added and Messages Alert.exe

description pid process

Token: SeDebugPrivilege 1284 New Email Added and Messages Alert.exe

pid	process
1284	New Email Added and Messages Alert.exe
1284	New Email Added and Messages Alert.exe

description	pid	process
Token: SeDebugPrivilege	1284	New Email Added and Messages Alert.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1960 wrote to memory of 1812	1960	wscript.exe	wscript.exe
PID 1960 wrote to memory of 1812	1960	wscript.exe	wscript.exe
PID 1960 wrote to memory of 1812	1960	wscript.exe	wscript.exe
PID 1960 wrote to memory of 1284	1960	wscript.exe	New Email Added and Messages Alert.exe
PID 1960 wrote to memory of 1284	1960	wscript.exe	New Email Added and Messages Alert.exe
PID 1960 wrote to memory of 1284	1960	wscript.exe	New Email Added and Messages Alert.exe
PID 1960 wrote to memory of 1284	1960	wscript.exe	New Email Added and Messages Alert.exe

outlook_office_path 1 IoCs

Processes:

New Email Added and Messages Alert.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New Email Added and Messages Alert.exe

outlook_win_path 1 IoCs

Processes:

New Email Added and Messages Alert.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New Email Added and Messages Alert.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\New Email Added and Messages Alert.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ezqHzyDEBJ.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1812

C:\Users\Admin\AppData\Local\Temp\New Email Added and Messages Alert.exe
"C:\Users\Admin\AppData\Local\Temp\New Email Added and Messages Alert.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\New Email Added and Messages Alert.exe
Filesize
209KB

MD5
e711faa67fee4611ead33d70cf480594

SHA1
04abd88d79bf2b0660bd20d94e01d37d75f76bd8

SHA256
da6985009226924a22f0b0a2a80163ff9e30e77d940ad3c0323f22bc748a284a

SHA512
d692a166356301478c7c24d4dc8601c31d986ddea03406f8810c31db526f62411d2b83a370e46716f63e8680b10ef0bdeaa7d9396bc063db25912ddf69f66dc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Email Added and Messages Alert.exe
Filesize
209KB

MD5
e711faa67fee4611ead33d70cf480594

SHA1
04abd88d79bf2b0660bd20d94e01d37d75f76bd8

SHA256
da6985009226924a22f0b0a2a80163ff9e30e77d940ad3c0323f22bc748a284a

SHA512
d692a166356301478c7c24d4dc8601c31d986ddea03406f8810c31db526f62411d2b83a370e46716f63e8680b10ef0bdeaa7d9396bc063db25912ddf69f66dc0

Download Submit
C:\Users\Admin\AppData\Roaming\ezqHzyDEBJ.js
Filesize
49KB

MD5
bdc987e24f3756203aba0bdad8f3f455

SHA1
f45575f65715623d255b8c3f403306ab8598b874

SHA256
deb124489dadb59b3c7a6afd7a6f774538935fb0968b04dd8ca6de104d2cc19b

SHA512
32ae2c2794ff4a5d662f013f946f1ef5ce0b489c171ed5991468ef82d011de952b78bb23a9428e3c2b96f140e1ece9cc81e308da698698b8dc18041bbd0a1805

Download Submit
memory/1284-57-0x0000000000000000-mapping.dmp

Download
memory/1284-61-0x00000000012A0000-0x00000000012DA000-memory.dmp

Filesize
232KB

Download
memory/1284-62-0x0000000075A61000-0x0000000075A63000-memory.dmp

Filesize
8KB

Download
memory/1812-55-0x0000000000000000-mapping.dmp

Download
memory/1960-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads