agenttesla | bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c | Triage

Analysis

max time kernel
62s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 09:49

Sharing

Report Analysis Logs

General

Target

bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe
Size

531KB
MD5

2095dfc217f35f5ca91e12f05986744e
SHA1

cb910d82a50b3b6a35cf29f114d095375d41f608
SHA256

bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c
SHA512

db03d898dbb7797b494b014cc76bee9c5083d214d84ad31b5fd23dbd2d08c4ffe3d387acfb4a9e4f75de08a53ca9fc152c331e8879213ee2bf0040105759dfd1

Score

10^/10

agenttesla collection keylogger rezer0 spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1708-60-0x0000000004F00000-0x0000000004F50000-memory.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

Processes:

resource	yara_rule
behavioral1/memory/1708-57-0x0000000000AB0000-0x0000000000B08000-memory.dmp	rezer0

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

Email Collection

Processes:

bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1988 schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

pid	process
1708	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe
1708	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

description pid process

Token: SeDebugPrivilege 1708 bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

description	pid	process	target process
PID 1708 wrote to memory of 1988	1708	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe	schtasks.exe
PID 1708 wrote to memory of 1988	1708	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe	schtasks.exe
PID 1708 wrote to memory of 1988	1708	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe	schtasks.exe
PID 1708 wrote to memory of 1988	1708	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe	schtasks.exe

outlook_office_path 1 IoCs

Processes:

bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

outlook_win_path 1 IoCs

Processes:

bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe

C:\Users\Admin\AppData\Local\Temp\bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe
"C:\Users\Admin\AppData\Local\Temp\bb4d493b59bbb2d69843af401dcd468ed0a8ed7c97932d99497a299d42ccaf3c.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1708

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HRcKLARyTrJxU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF03.tmp"
2⤵
- Creates scheduled task(s)
PID:1988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCF03.tmp
Filesize
1KB

MD5
44834293fed86eb0cbc3f28a172f0c83

SHA1
92457e7cc3043bcedd8686d5ba0bd700447b4184

SHA256
57cc4ecd335628d8e7b628d804e87cdbd42bacbd91ba4f619d0ad529473e7867

SHA512
5fe1b662223749b8829f5883ad270ba46b5cff489c2fb9ff90cf231bf8859fbb1c4b30ad67f4d43f357e10725b7a87dcc56b822d0b576a9b068652ea5a7bc10c

Download Submit
memory/1708-54-0x0000000000D90000-0x0000000000E1A000-memory.dmp

Filesize
552KB

Download
memory/1708-55-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download
memory/1708-57-0x0000000000AB0000-0x0000000000B08000-memory.dmp

Filesize
352KB

Download
memory/1708-60-0x0000000004F00000-0x0000000004F50000-memory.dmp

Filesize
320KB

Download
memory/1988-58-0x0000000000000000-mapping.dmp

Download