agenttesla | 186f5806f8653396518a7c36dbe610b5dc0733b15b86543f81c7380698d39428

General

Target

Documents for your perusal.js
Size

450KB
MD5

8d006d2e9172f2ba4c156eb100bd31c9
SHA1

39f1c16f43c879986747bcdc49a7a75c7a03f0df
SHA256

1f0f209552a8710e45b93d500959e04bb4e0cef99e268e1b77419fb50c62cfbd
SHA512

b1929743781911ee7b6ed928c4dcef8fe199fe2f6850d5a22eba49fb53efad1684a601fef8f1619f9bece4a3f75703fb0e59d985e98053f485b3a2911472e44b

Score

10^/10

agenttesla vjw0rm collection keylogger persistence spyware stealer suricata trojan worm

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
files.000webhost.com
Port:
21
Username:
zincox
Password:
computer@1010

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://files.000webhost.com/
Port:
21
Username:
zincox
Password:
computer@1010

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
suricata: ET MALWARE AgentTesla Exfil via FTP
suricata: ET MALWARE AgentTesla Exfil via FTP
suricata
Blocklisted process makes network request 8 IoCs

Processes:

wscript.exe

flow pid process

6 2008 wscript.exe
9 2008 wscript.exe
11 2008 wscript.exe
13 2008 wscript.exe
14 2008 wscript.exe
15 2008 wscript.exe
17 2008 wscript.exe
18 2008 wscript.exe
Executes dropped EXE 1 IoCs

Processes:

Zxx.exe

pid process

1008 Zxx.exe

flow	pid	process
6	2008	wscript.exe
9	2008	wscript.exe
11	2008	wscript.exe
13	2008	wscript.exe
14	2008	wscript.exe
15	2008	wscript.exe
17	2008	wscript.exe
18	2008	wscript.exe

pid	process
1008	Zxx.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oItJmnUZpa.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oItJmnUZpa.js	wscript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Zxx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Zxx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Zxx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Zxx.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\oItJmnUZpa.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Zxx.exe

pid process

1008 Zxx.exe
1008 Zxx.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Zxx.exe

description pid process

Token: SeDebugPrivilege 1008 Zxx.exe

pid	process
1008	Zxx.exe
1008	Zxx.exe

description	pid	process
Token: SeDebugPrivilege	1008	Zxx.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2044 wrote to memory of 2008	2044	wscript.exe	wscript.exe
PID 2044 wrote to memory of 2008	2044	wscript.exe	wscript.exe
PID 2044 wrote to memory of 2008	2044	wscript.exe	wscript.exe
PID 2044 wrote to memory of 1008	2044	wscript.exe	Zxx.exe
PID 2044 wrote to memory of 1008	2044	wscript.exe	Zxx.exe
PID 2044 wrote to memory of 1008	2044	wscript.exe	Zxx.exe
PID 2044 wrote to memory of 1008	2044	wscript.exe	Zxx.exe

outlook_office_path 1 IoCs

Processes:

Zxx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Zxx.exe

outlook_win_path 1 IoCs

Processes:

Zxx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Zxx.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Documents for your perusal.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oItJmnUZpa.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2008

C:\Users\Admin\AppData\Local\Temp\Zxx.exe
"C:\Users\Admin\AppData\Local\Temp\Zxx.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Zxx.exe
Filesize
209KB

MD5
e711faa67fee4611ead33d70cf480594

SHA1
04abd88d79bf2b0660bd20d94e01d37d75f76bd8

SHA256
da6985009226924a22f0b0a2a80163ff9e30e77d940ad3c0323f22bc748a284a

SHA512
d692a166356301478c7c24d4dc8601c31d986ddea03406f8810c31db526f62411d2b83a370e46716f63e8680b10ef0bdeaa7d9396bc063db25912ddf69f66dc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zxx.exe
Filesize
209KB

MD5
e711faa67fee4611ead33d70cf480594

SHA1
04abd88d79bf2b0660bd20d94e01d37d75f76bd8

SHA256
da6985009226924a22f0b0a2a80163ff9e30e77d940ad3c0323f22bc748a284a

SHA512
d692a166356301478c7c24d4dc8601c31d986ddea03406f8810c31db526f62411d2b83a370e46716f63e8680b10ef0bdeaa7d9396bc063db25912ddf69f66dc0

Download Submit
C:\Users\Admin\AppData\Roaming\oItJmnUZpa.js
Filesize
28KB

MD5
5de1afcc19fea0919a3e4ecd65f90e15

SHA1
6aa211c61c3edefea543414993a943b67a89d9ef

SHA256
cf8d16624b0987294b2a9f37818ace0964021b32f0736e4bff70563258dc523f

SHA512
e3798ca4fad1d914906711c540bb4fb803f4c63c510f13358ca4ad1e4df0a086e0421e4a71a15f062cd0b4b4d29eb7e7fa67e55750aeb58e9a7c74f161d20bf8

Download Submit
memory/1008-57-0x0000000000000000-mapping.dmp

Download
memory/1008-61-0x0000000001310000-0x000000000134A000-memory.dmp

Filesize
232KB

Download
memory/1008-62-0x0000000076C81000-0x0000000076C83000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x000007FEFC5C1000-0x000007FEFC5C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads