agenttesla | c3fb8b20af40e3a6905a1190d657bd725c241efa3d91d0c0e1546f2b8ae8a2ff

General

Target

PAYMENTTRF889020022.exe
Size

355KB
MD5

1d00728cbb02b69a8cad3f032be410c8
SHA1

a803d959e77cdbec645288fe922d12e6888a209a
SHA256

c3fb8b20af40e3a6905a1190d657bd725c241efa3d91d0c0e1546f2b8ae8a2ff
SHA512

8858475d2f17f2f6786cbcd33f64bcb1515c931fd095d7d1828b1765dca3d47e454ef961c3ce4e41c9087494530694ede7475c8f31d4d549a9b2d913cc5d7257
SSDEEP

6144:HNeZmLE2rXehVTdEMLjtEkzKJg5/mnc52iOu0anAU5hvrBAVGFryDgvMar819nYk:HNl9KhVTtLjmkzufc5D0aBvrXVkgzr85

Score

10^/10

agenttesla nanocore collection evasion keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.collinssaludnatural.com
Port:
21
Username:
cargo@collinssaludnatural.com
Password:
1Hhzqx^s+8Oe

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.collinssaludnatural.com/
Port:
21
Username:
cargo@collinssaludnatural.com
Password:
1Hhzqx^s+8Oe

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

bglfezp.execargo bin stub.exe

pid process

1344 bglfezp.exe
3856 cargo bin stub.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

bglfezp.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation bglfezp.exe
Loads dropped DLL 1 IoCs

Processes:

bglfezp.exe

pid process

1368 bglfezp.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1344	bglfezp.exe
3856	cargo bin stub.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bglfezp.exe

pid	process
1368	bglfezp.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

cargo bin stub.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

bglfezp.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bglfezp.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

bglfezp.exe

description pid process target process

PID 1344 set thread context of 1368 1344 bglfezp.exe bglfezp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1556 1344 WerFault.exe bglfezp.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bglfezp.execargo bin stub.exe

pid process

1368 bglfezp.exe
1368 bglfezp.exe
1368 bglfezp.exe
1368 bglfezp.exe
1368 bglfezp.exe
1368 bglfezp.exe
3856 cargo bin stub.exe
3856 cargo bin stub.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bglfezp.exe

pid process

1368 bglfezp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bglfezp.execargo bin stub.exe

description pid process

Token: SeDebugPrivilege 1368 bglfezp.exe
Token: SeDebugPrivilege 3856 cargo bin stub.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bglfezp.exe

description	pid	process	target process
PID 1344 set thread context of 1368	1344	bglfezp.exe	bglfezp.exe

pid	pid_target	process	target process
1556	1344	WerFault.exe	bglfezp.exe

pid	process
1368	bglfezp.exe
1368	bglfezp.exe
1368	bglfezp.exe
1368	bglfezp.exe
1368	bglfezp.exe
1368	bglfezp.exe
3856	cargo bin stub.exe
3856	cargo bin stub.exe

pid	process
1368	bglfezp.exe

description	pid	process
Token: SeDebugPrivilege	1368	bglfezp.exe
Token: SeDebugPrivilege	3856	cargo bin stub.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

PAYMENTTRF889020022.exebglfezp.exebglfezp.exe

description	pid	process	target process
PID 4396 wrote to memory of 1344	4396	PAYMENTTRF889020022.exe	bglfezp.exe
PID 4396 wrote to memory of 1344	4396	PAYMENTTRF889020022.exe	bglfezp.exe
PID 4396 wrote to memory of 1344	4396	PAYMENTTRF889020022.exe	bglfezp.exe
PID 1344 wrote to memory of 1368	1344	bglfezp.exe	bglfezp.exe
PID 1344 wrote to memory of 1368	1344	bglfezp.exe	bglfezp.exe
PID 1344 wrote to memory of 1368	1344	bglfezp.exe	bglfezp.exe
PID 1344 wrote to memory of 1368	1344	bglfezp.exe	bglfezp.exe
PID 1368 wrote to memory of 3856	1368	bglfezp.exe	cargo bin stub.exe
PID 1368 wrote to memory of 3856	1368	bglfezp.exe	cargo bin stub.exe
PID 1368 wrote to memory of 3856	1368	bglfezp.exe	cargo bin stub.exe

outlook_office_path 1 IoCs

Processes:

cargo bin stub.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe

outlook_win_path 1 IoCs

Processes:

cargo bin stub.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cargo bin stub.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENTTRF889020022.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENTTRF889020022.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4396

C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
"C:\Users\Admin\AppData\Local\Temp\bglfezp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1344

C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
"C:\Users\Admin\AppData\Local\Temp\bglfezp.exe"
3⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Local\Temp\cargo bin stub.exe
"C:\Users\Admin\AppData\Local\Temp\cargo bin stub.exe"
4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 540
3⤵
- Program crash
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1344 -ip 1344
1⤵
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
Filesize
125KB

MD5
8dca1faf45a7de90e2a67b3c724d9c14

SHA1
a48123b3a5e70f484566e55d92f2772e34393b92

SHA256
0b0f985c493696c622017a28c979417c5be084d91b7976eab2397e9ac5bbfeb8

SHA512
b54f138c7e432ea1ef14f8594a5e379f703d88d63d9ce69b2415cf88fb7cdea657e5a3b3d57bb2bfda0fc24c730cedc4dbe789a5b3e1b2089fa7b32807ea6d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
Filesize
125KB

MD5
8dca1faf45a7de90e2a67b3c724d9c14

SHA1
a48123b3a5e70f484566e55d92f2772e34393b92

SHA256
0b0f985c493696c622017a28c979417c5be084d91b7976eab2397e9ac5bbfeb8

SHA512
b54f138c7e432ea1ef14f8594a5e379f703d88d63d9ce69b2415cf88fb7cdea657e5a3b3d57bb2bfda0fc24c730cedc4dbe789a5b3e1b2089fa7b32807ea6d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bglfezp.exe
Filesize
125KB

MD5
8dca1faf45a7de90e2a67b3c724d9c14

SHA1
a48123b3a5e70f484566e55d92f2772e34393b92

SHA256
0b0f985c493696c622017a28c979417c5be084d91b7976eab2397e9ac5bbfeb8

SHA512
b54f138c7e432ea1ef14f8594a5e379f703d88d63d9ce69b2415cf88fb7cdea657e5a3b3d57bb2bfda0fc24c730cedc4dbe789a5b3e1b2089fa7b32807ea6d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cargo bin stub.exe
Filesize
208KB

MD5
8c84f344dc0e2d2d9280b5530fea429f

SHA1
0827eee176132340f3b537b90317938390f1e40e

SHA256
e041425918d874f81b89564074230c8dbb66d66a40e2f5cef1df119cfde1db5a

SHA512
574018df4b43d00173d4088d8707627f738c2205b0da21f63f7a51705f9983eda66dcc4272b388f7545bc7222411a3a65b21acd595071a80f116b2384a5761f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cargo bin stub.exe
Filesize
208KB

MD5
8c84f344dc0e2d2d9280b5530fea429f

SHA1
0827eee176132340f3b537b90317938390f1e40e

SHA256
e041425918d874f81b89564074230c8dbb66d66a40e2f5cef1df119cfde1db5a

SHA512
574018df4b43d00173d4088d8707627f738c2205b0da21f63f7a51705f9983eda66dcc4272b388f7545bc7222411a3a65b21acd595071a80f116b2384a5761f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\lrlhc.kev
Filesize
280KB

MD5
4fa4f199d63df6ed8ab5185bd28acef5

SHA1
8021bc2518851cd10202c3923a6de177c830d09f

SHA256
03062221476d82fd59234117006236c4d88bc247c5b38894393c28caba795399

SHA512
84d2a9021282d702cc951819c886c6dd8db4cad2ae8b5a3b609c64af6a1e2b5c3643c68e3bcad7a49db8a364e83626ea5867614e81c45e37fcc3be511e06f30a

Download Submit
C:\Users\Admin\AppData\Local\Temp\soocvvyw.hsf
Filesize
4KB

MD5
1a8c85947e15b903b353a69704452e22

SHA1
93941b1e770b673698b1ae338156d16257d94db4

SHA256
06f20357f36314fb82d550011bdbbdef7e9ce4ceac791c133e537cafe3b62c83

SHA512
b9ae1d779e8e2ff999073477765df2bf665219e670d250727c6177de039ff7cef800f9590084dd5d1d1bc02cad3895ea9e9f2b6068229a755ef8609e3e022318

Download Submit
memory/1344-132-0x0000000000000000-mapping.dmp

Download
memory/1368-140-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/1368-141-0x0000000005A10000-0x0000000005AAC000-memory.dmp

Filesize
624KB

Download
memory/1368-142-0x00000000059A0000-0x00000000059AA000-memory.dmp

Filesize
40KB

Download
memory/1368-143-0x0000000007200000-0x0000000007266000-memory.dmp

Filesize
408KB

Download
memory/1368-139-0x0000000005E80000-0x0000000006424000-memory.dmp

Filesize
5.6MB

Download
memory/1368-137-0x0000000000000000-mapping.dmp

Download
memory/3856-144-0x0000000000000000-mapping.dmp

Download
memory/3856-147-0x0000000000430000-0x000000000046A000-memory.dmp

Filesize
232KB

Download
memory/3856-148-0x0000000005F60000-0x0000000005FB0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads