agenttesla | 71720ec77fe5f1bf93446abc71b1ae23da1e5bff3d45ca6eb0d52e8739e4a155

General

Target

Doc1507161RFQ.exe
Size

28KB
MD5

b96e3b103aa07bd9348f3d5d265b15ab
SHA1

710b1bbbc832ee1941d0c8ed720a9876ad3e0ffd
SHA256

71720ec77fe5f1bf93446abc71b1ae23da1e5bff3d45ca6eb0d52e8739e4a155
SHA512

619ce6991a5fbad06447d8b01a6d31062c4d8da790e550f32957955adce4d965bb4321d70d5400876733c952b1ad1975b4a38a0c1a68ff538f0991b1c7abfcac
SSDEEP

192:DQnIue9/6LKH75zAf8+yG2WWaP0xaZ/mhhhhhhyixp6Xw+Cp2qkFt5:MIP9yLm5zt+Cfasxc+hhhhhht5+pR

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

http://45.155.165.63/ch1t/inc/c20966a2dd74ab.php

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

8 1048 wscript.exe
10 1048 wscript.exe
11 1048 wscript.exe

flow	pid	process
8	1048	wscript.exe
10	1048	wscript.exe
11	1048	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exeWScript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Exeyjnirhcoeobuild.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Exeyjnirhcoeobuild.js	WScript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Doc1507161RFQ.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Doc1507161RFQ.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Doc1507161RFQ.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Doc1507161RFQ.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exeDoc1507161RFQ.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Exeyjnirhcoeobuild = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Exeyjnirhcoeobuild.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "\"C:\\Users\\Admin\\AppData\\Roaming\\docs\\office.exe\""	Doc1507161RFQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exeyjnirhcoeobuild = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Exeyjnirhcoeobuild.js\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Exeyjnirhcoeobuild = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Exeyjnirhcoeobuild.js\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\software\microsoft\windows\currentversion\run	WScript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exeyjnirhcoeobuild = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Exeyjnirhcoeobuild.js\""	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Doc1507161RFQ.exe

description pid process target process

PID 456 set thread context of 1300 456 Doc1507161RFQ.exe Doc1507161RFQ.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exeDoc1507161RFQ.exeDoc1507161RFQ.exe

pid process

1508 powershell.exe
456 Doc1507161RFQ.exe
456 Doc1507161RFQ.exe
1300 Doc1507161RFQ.exe
1300 Doc1507161RFQ.exe

description	pid	process	target process
PID 456 set thread context of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe

pid	process
1508	powershell.exe
456	Doc1507161RFQ.exe
456	Doc1507161RFQ.exe
1300	Doc1507161RFQ.exe
1300	Doc1507161RFQ.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Doc1507161RFQ.exepowershell.exeDoc1507161RFQ.exe

description	pid	process
Token: SeDebugPrivilege	456	Doc1507161RFQ.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	1300	Doc1507161RFQ.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Doc1507161RFQ.exe

pid process

1300 Doc1507161RFQ.exe

pid	process
1300	Doc1507161RFQ.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Doc1507161RFQ.exeWScript.exe

description	pid	process	target process
PID 456 wrote to memory of 1508	456	Doc1507161RFQ.exe	powershell.exe
PID 456 wrote to memory of 1508	456	Doc1507161RFQ.exe	powershell.exe
PID 456 wrote to memory of 1508	456	Doc1507161RFQ.exe	powershell.exe
PID 456 wrote to memory of 1508	456	Doc1507161RFQ.exe	powershell.exe
PID 456 wrote to memory of 1304	456	Doc1507161RFQ.exe	WScript.exe
PID 456 wrote to memory of 1304	456	Doc1507161RFQ.exe	WScript.exe
PID 456 wrote to memory of 1304	456	Doc1507161RFQ.exe	WScript.exe
PID 456 wrote to memory of 1304	456	Doc1507161RFQ.exe	WScript.exe
PID 1304 wrote to memory of 1048	1304	WScript.exe	wscript.exe
PID 1304 wrote to memory of 1048	1304	WScript.exe	wscript.exe
PID 1304 wrote to memory of 1048	1304	WScript.exe	wscript.exe
PID 1304 wrote to memory of 1048	1304	WScript.exe	wscript.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe
PID 456 wrote to memory of 1300	456	Doc1507161RFQ.exe	Doc1507161RFQ.exe

outlook_office_path 1 IoCs

Processes:

Doc1507161RFQ.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Doc1507161RFQ.exe

outlook_win_path 1 IoCs

Processes:

Doc1507161RFQ.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Doc1507161RFQ.exe

C:\Users\Admin\AppData\Local\Temp\Doc1507161RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\Doc1507161RFQ.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Exeyjnirhcoeobuild.js"
2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Exeyjnirhcoeobuild.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1048

C:\Users\Admin\AppData\Local\Temp\Doc1507161RFQ.exe
C:\Users\Admin\AppData\Local\Temp\Doc1507161RFQ.exe
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Exeyjnirhcoeobuild.js

Filesize
21KB

MD5
cbae567eae4873a19dc1d77885e3ea0f

SHA1
669b5cce2f71651aac783b714140e20552c244fe

SHA256
30e25144d8c3639fad6741c664ce2444076a53176acd50c0760c71c800c05d79

SHA512
85a25484308c03b70418a86878c67a0b0689b1c5f55a78e4c835d5ccb3b256b4b53344d97f6779320d6d0ee50077afb9938e95a32b5058a3c4df100db481c4c9

Download Submit
C:\Users\Admin\AppData\Roaming\Exeyjnirhcoeobuild.js

Filesize
21KB

MD5
cbae567eae4873a19dc1d77885e3ea0f

SHA1
669b5cce2f71651aac783b714140e20552c244fe

SHA256
30e25144d8c3639fad6741c664ce2444076a53176acd50c0760c71c800c05d79

SHA512
85a25484308c03b70418a86878c67a0b0689b1c5f55a78e4c835d5ccb3b256b4b53344d97f6779320d6d0ee50077afb9938e95a32b5058a3c4df100db481c4c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Exeyjnirhcoeobuild.js

Filesize
21KB

MD5
13632cdf1e0ece6910a0bbce4271a3e4

SHA1
d462a082e5c7366fd992547dca1c5dbed6aeddf0

SHA256
0e74f9752e3f1275513a056fb3cf6e7cb6c895b24240e2ba94f7fe8b1ef5f74b

SHA512
10d5cd2392303a57c28ccfcdbedb475dcf6c9f7773f9748987efc83a68c84ae0e21468fef889b5651cf874fc1736a7ef4879ff5b803782082e0eb512f49d8df5

Download Submit
memory/456-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/456-56-0x0000000004E60000-0x0000000004F18000-memory.dmp

Filesize
736KB

Download
memory/456-57-0x00000000048F0000-0x0000000004982000-memory.dmp

Filesize
584KB

Download
memory/456-54-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Filesize
48KB

Download
memory/1048-66-0x0000000000000000-mapping.dmp

Download
memory/1300-73-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1300-70-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1300-71-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1300-74-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1300-76-0x000000000043598E-mapping.dmp

Download
memory/1300-75-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1300-80-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1300-78-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1304-63-0x0000000000000000-mapping.dmp

Download
memory/1508-62-0x000000006F040000-0x000000006F5EB000-memory.dmp

Filesize
5.7MB

Download
memory/1508-61-0x000000006F040000-0x000000006F5EB000-memory.dmp

Filesize
5.7MB

Download
memory/1508-60-0x000000006F040000-0x000000006F5EB000-memory.dmp

Filesize
5.7MB

Download
memory/1508-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads