agenttesla | c3fb8b20af40e3a6905a1190d657bd725c241efa3d91d0c0e1546f2b8ae8a2ff

Analysis

max time kernel
83s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAYMENTTRF889020022.exe
Size

355KB
MD5

1d00728cbb02b69a8cad3f032be410c8
SHA1

a803d959e77cdbec645288fe922d12e6888a209a
SHA256

c3fb8b20af40e3a6905a1190d657bd725c241efa3d91d0c0e1546f2b8ae8a2ff
SHA512

8858475d2f17f2f6786cbcd33f64bcb1515c931fd095d7d1828b1765dca3d47e454ef961c3ce4e41c9087494530694ede7475c8f31d4d549a9b2d913cc5d7257
SSDEEP

6144:HNeZmLE2rXehVTdEMLjtEkzKJg5/mnc52iOu0anAU5hvrBAVGFryDgvMar819nYk:HNl9KhVTtLjmkzufc5D0aBvrXVkgzr85

Score

10^/10

agenttesla nanocore collection evasion keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.collinssaludnatural.com
Port:
21
Username:
cargo@collinssaludnatural.com
Password:
1Hhzqx^s+8Oe

Extracted

Family

nanocore

Version

1.2.2.0

37.0.14.210:6060

127.0.0.1:6060

Mutex

9fc6520a-b866-467e-b702-7533f9b56460

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-04-25T14:53:00.256026436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
6060
default_group
SWIFT
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9fc6520a-b866-467e-b702-7533f9b56460
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
37.0.14.210
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.collinssaludnatural.com/
Port:
21
Username:
cargo@collinssaludnatural.com
Password:
1Hhzqx^s+8Oe

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

bglfezp.execargo bin stub.exe

pid process

1596 bglfezp.exe
1072 cargo bin stub.exe
Loads dropped DLL 4 IoCs

Processes:

PAYMENTTRF889020022.exebglfezp.exebglfezp.exe

pid process

1600 PAYMENTTRF889020022.exe
1596 bglfezp.exe
1868 bglfezp.exe
1868 bglfezp.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1596	bglfezp.exe
1072	cargo bin stub.exe

pid	process
1600	PAYMENTTRF889020022.exe
1596	bglfezp.exe
1868	bglfezp.exe
1868	bglfezp.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

cargo bin stub.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

bglfezp.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bglfezp.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

bglfezp.exe

description pid process target process

PID 1596 set thread context of 1868 1596 bglfezp.exe bglfezp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

bglfezp.execargo bin stub.exe

pid process

1868 bglfezp.exe
1868 bglfezp.exe
1868 bglfezp.exe
1868 bglfezp.exe
1072 cargo bin stub.exe
1072 cargo bin stub.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bglfezp.exe

pid process

1868 bglfezp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bglfezp.execargo bin stub.exe

description pid process

Token: SeDebugPrivilege 1868 bglfezp.exe
Token: SeDebugPrivilege 1072 cargo bin stub.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bglfezp.exe

description	pid	process	target process
PID 1596 set thread context of 1868	1596	bglfezp.exe	bglfezp.exe

pid	process
1868	bglfezp.exe
1868	bglfezp.exe
1868	bglfezp.exe
1868	bglfezp.exe
1072	cargo bin stub.exe
1072	cargo bin stub.exe

pid	process
1868	bglfezp.exe

description	pid	process
Token: SeDebugPrivilege	1868	bglfezp.exe
Token: SeDebugPrivilege	1072	cargo bin stub.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PAYMENTTRF889020022.exebglfezp.exebglfezp.exe

description	pid	process	target process
PID 1600 wrote to memory of 1596	1600	PAYMENTTRF889020022.exe	bglfezp.exe
PID 1600 wrote to memory of 1596	1600	PAYMENTTRF889020022.exe	bglfezp.exe
PID 1600 wrote to memory of 1596	1600	PAYMENTTRF889020022.exe	bglfezp.exe
PID 1600 wrote to memory of 1596	1600	PAYMENTTRF889020022.exe	bglfezp.exe
PID 1596 wrote to memory of 1868	1596	bglfezp.exe	bglfezp.exe
PID 1596 wrote to memory of 1868	1596	bglfezp.exe	bglfezp.exe
PID 1596 wrote to memory of 1868	1596	bglfezp.exe	bglfezp.exe
PID 1596 wrote to memory of 1868	1596	bglfezp.exe	bglfezp.exe
PID 1596 wrote to memory of 1868	1596	bglfezp.exe	bglfezp.exe
PID 1868 wrote to memory of 1072	1868	bglfezp.exe	cargo bin stub.exe
PID 1868 wrote to memory of 1072	1868	bglfezp.exe	cargo bin stub.exe
PID 1868 wrote to memory of 1072	1868	bglfezp.exe	cargo bin stub.exe
PID 1868 wrote to memory of 1072	1868	bglfezp.exe	cargo bin stub.exe

outlook_office_path 1 IoCs

Processes:

cargo bin stub.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe

outlook_win_path 1 IoCs

Processes:

cargo bin stub.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENTTRF889020022.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENTTRF889020022.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
"C:\Users\Admin\AppData\Local\Temp\bglfezp.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1596

C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
"C:\Users\Admin\AppData\Local\Temp\bglfezp.exe"
3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Local\Temp\cargo bin stub.exe
"C:\Users\Admin\AppData\Local\Temp\cargo bin stub.exe"
4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
Filesize
125KB

MD5
8dca1faf45a7de90e2a67b3c724d9c14

SHA1
a48123b3a5e70f484566e55d92f2772e34393b92

SHA256
0b0f985c493696c622017a28c979417c5be084d91b7976eab2397e9ac5bbfeb8

SHA512
b54f138c7e432ea1ef14f8594a5e379f703d88d63d9ce69b2415cf88fb7cdea657e5a3b3d57bb2bfda0fc24c730cedc4dbe789a5b3e1b2089fa7b32807ea6d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
Filesize
125KB

MD5
8dca1faf45a7de90e2a67b3c724d9c14

SHA1
a48123b3a5e70f484566e55d92f2772e34393b92

SHA256
0b0f985c493696c622017a28c979417c5be084d91b7976eab2397e9ac5bbfeb8

SHA512
b54f138c7e432ea1ef14f8594a5e379f703d88d63d9ce69b2415cf88fb7cdea657e5a3b3d57bb2bfda0fc24c730cedc4dbe789a5b3e1b2089fa7b32807ea6d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
Filesize
125KB

MD5
8dca1faf45a7de90e2a67b3c724d9c14

SHA1
a48123b3a5e70f484566e55d92f2772e34393b92

SHA256
0b0f985c493696c622017a28c979417c5be084d91b7976eab2397e9ac5bbfeb8

SHA512
b54f138c7e432ea1ef14f8594a5e379f703d88d63d9ce69b2415cf88fb7cdea657e5a3b3d57bb2bfda0fc24c730cedc4dbe789a5b3e1b2089fa7b32807ea6d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cargo bin stub.exe
Filesize
208KB

MD5
8c84f344dc0e2d2d9280b5530fea429f

SHA1
0827eee176132340f3b537b90317938390f1e40e

SHA256
e041425918d874f81b89564074230c8dbb66d66a40e2f5cef1df119cfde1db5a

SHA512
574018df4b43d00173d4088d8707627f738c2205b0da21f63f7a51705f9983eda66dcc4272b388f7545bc7222411a3a65b21acd595071a80f116b2384a5761f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cargo bin stub.exe
Filesize
208KB

MD5
8c84f344dc0e2d2d9280b5530fea429f

SHA1
0827eee176132340f3b537b90317938390f1e40e

SHA256
e041425918d874f81b89564074230c8dbb66d66a40e2f5cef1df119cfde1db5a

SHA512
574018df4b43d00173d4088d8707627f738c2205b0da21f63f7a51705f9983eda66dcc4272b388f7545bc7222411a3a65b21acd595071a80f116b2384a5761f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\lrlhc.kev
Filesize
280KB

MD5
4fa4f199d63df6ed8ab5185bd28acef5

SHA1
8021bc2518851cd10202c3923a6de177c830d09f

SHA256
03062221476d82fd59234117006236c4d88bc247c5b38894393c28caba795399

SHA512
84d2a9021282d702cc951819c886c6dd8db4cad2ae8b5a3b609c64af6a1e2b5c3643c68e3bcad7a49db8a364e83626ea5867614e81c45e37fcc3be511e06f30a

Download Submit
C:\Users\Admin\AppData\Local\Temp\soocvvyw.hsf
Filesize
4KB

MD5
1a8c85947e15b903b353a69704452e22

SHA1
93941b1e770b673698b1ae338156d16257d94db4

SHA256
06f20357f36314fb82d550011bdbbdef7e9ce4ceac791c133e537cafe3b62c83

SHA512
b9ae1d779e8e2ff999073477765df2bf665219e670d250727c6177de039ff7cef800f9590084dd5d1d1bc02cad3895ea9e9f2b6068229a755ef8609e3e022318

Download Submit
\Users\Admin\AppData\Local\Temp\bglfezp.exe
Filesize
125KB

MD5
8dca1faf45a7de90e2a67b3c724d9c14

SHA1
a48123b3a5e70f484566e55d92f2772e34393b92

SHA256
0b0f985c493696c622017a28c979417c5be084d91b7976eab2397e9ac5bbfeb8

SHA512
b54f138c7e432ea1ef14f8594a5e379f703d88d63d9ce69b2415cf88fb7cdea657e5a3b3d57bb2bfda0fc24c730cedc4dbe789a5b3e1b2089fa7b32807ea6d3b

Download Submit
\Users\Admin\AppData\Local\Temp\bglfezp.exe
Filesize
125KB

MD5
8dca1faf45a7de90e2a67b3c724d9c14

SHA1
a48123b3a5e70f484566e55d92f2772e34393b92

SHA256
0b0f985c493696c622017a28c979417c5be084d91b7976eab2397e9ac5bbfeb8

SHA512
b54f138c7e432ea1ef14f8594a5e379f703d88d63d9ce69b2415cf88fb7cdea657e5a3b3d57bb2bfda0fc24c730cedc4dbe789a5b3e1b2089fa7b32807ea6d3b

Download Submit
\Users\Admin\AppData\Local\Temp\cargo bin stub.exe
Filesize
208KB

MD5
8c84f344dc0e2d2d9280b5530fea429f

SHA1
0827eee176132340f3b537b90317938390f1e40e

SHA256
e041425918d874f81b89564074230c8dbb66d66a40e2f5cef1df119cfde1db5a

SHA512
574018df4b43d00173d4088d8707627f738c2205b0da21f63f7a51705f9983eda66dcc4272b388f7545bc7222411a3a65b21acd595071a80f116b2384a5761f2

Download Submit
memory/1072-85-0x00000000008F0000-0x000000000092A000-memory.dmp

Filesize
232KB

Download
memory/1072-82-0x0000000000000000-mapping.dmp

Download
memory/1596-56-0x0000000000000000-mapping.dmp

Download
memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1868-69-0x0000000001FC0000-0x0000000001FD2000-memory.dmp

Filesize
72KB

Download
memory/1868-78-0x0000000004B10000-0x0000000004B1E000-memory.dmp

Filesize
56KB

Download
memory/1868-71-0x0000000004300000-0x000000000430E000-memory.dmp

Filesize
56KB

Download
memory/1868-72-0x0000000004310000-0x0000000004322000-memory.dmp

Filesize
72KB

Download
memory/1868-73-0x0000000004AC0000-0x0000000004ACE000-memory.dmp

Filesize
56KB

Download
memory/1868-74-0x0000000004AD0000-0x0000000004ADC000-memory.dmp

Filesize
48KB

Download
memory/1868-75-0x0000000004AE0000-0x0000000004AF4000-memory.dmp

Filesize
80KB

Download
memory/1868-76-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/1868-77-0x0000000004B00000-0x0000000004B14000-memory.dmp

Filesize
80KB

Download
memory/1868-70-0x00000000042E0000-0x00000000042FA000-memory.dmp

Filesize
104KB

Download
memory/1868-79-0x0000000004DF0000-0x0000000004E1E000-memory.dmp

Filesize
184KB

Download
memory/1868-80-0x0000000004B40000-0x0000000004B54000-memory.dmp

Filesize
80KB

Download
memory/1868-68-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/1868-67-0x00000000006B0000-0x00000000006CE000-memory.dmp

Filesize
120KB

Download
memory/1868-66-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/1868-65-0x00000000004F0000-0x0000000000528000-memory.dmp

Filesize
224KB

Download
memory/1868-62-0x0000000000401896-mapping.dmp

Download