agenttesla | 5b086d5fdd4e2bcf856eb5ee73d1b139589c12d3416abf3ce75042bbdf4ed374

Analysis

max time kernel
47s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/11/2022, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Garf.Gen.6.22631.244.exe
Size 465KB
Sample221118-d62wysce21
SHA256 5b086d5fdd4e2bcf856eb5ee73d1b139589c12d3416abf3ce75042bbdf4ed374
MD5 121b82c12327e064193cbd25839526d8
SHA1 6d654504ba1ffd82d338634995bfe375e3ed8cae
SHA512 b3741566d6a411b77a29b07bcae51f16642a7598be3d615d726805d6ba99d090f240e635f044d37df6bcd8c8be5143cb888ec9aa333ed5f9556ec924cd3cbaa8
SSDEEP 12288:XTiLjylSOGyB5qGyWOgLcITn0OVVYjB0mtIr7FBxx:X2/ylxGyB5qG5FLH0AVa0mtIVbx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
webmail.jackbarber.com
Port
587
Username
[email protected]
Password
kJr=Jb5MV.7h
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
1172	suiwrm.exe
560	suiwrm.exe

Loads dropped DLL 2 IoCs

pid	Process
740	SecuriteInfo.com.Trojan.Garf.Gen.6.22631.244.exe
1172	suiwrm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	suiwrm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	suiwrm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	suiwrm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\utscn = "C:\\Users\\Admin\\AppData\\Roaming\\yvmnllqobkmgdf\\rirvxa.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\suiwrm.exe\""	suiwrm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\APP = "C:\\Users\\Admin\\AppData\\Roaming\\APP\\APP.exe"	suiwrm.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 560	1172	suiwrm.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
560	suiwrm.exe
560	suiwrm.exe
560	suiwrm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1172	suiwrm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	suiwrm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1172	740	SecuriteInfo.com.Trojan.Garf.Gen.6.22631.244.exe	27
PID 740 wrote to memory of 1172	740	SecuriteInfo.com.Trojan.Garf.Gen.6.22631.244.exe	27
PID 740 wrote to memory of 1172	740	SecuriteInfo.com.Trojan.Garf.Gen.6.22631.244.exe	27
PID 740 wrote to memory of 1172	740	SecuriteInfo.com.Trojan.Garf.Gen.6.22631.244.exe	27
PID 1172 wrote to memory of 560	1172	suiwrm.exe	28
PID 1172 wrote to memory of 560	1172	suiwrm.exe	28
PID 1172 wrote to memory of 560	1172	suiwrm.exe	28
PID 1172 wrote to memory of 560	1172	suiwrm.exe	28
PID 1172 wrote to memory of 560	1172	suiwrm.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	suiwrm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	suiwrm.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Garf.Gen.6.22631.244.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Garf.Gen.6.22631.244.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\suiwrm.exe
  "C:\Users\Admin\AppData\Local\Temp\suiwrm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\suiwrm.exe
    "C:\Users\Admin\AppData\Local\Temp\suiwrm.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dvyuwwsqp.e

Path C:\Users\Admin\AppData\Local\Temp\dvyuwwsqp.e
Size 296KB
SHA256 7b6fda1477b94169c95560fb8c12aa8053b1fbd07e65d7e914cca0330735d4e8
MD5 c3290f6cb5fbf1ead8891f34d9a3d2f6
SHA1 7bca52e7e3acb6fa59d85db2e364079b40e96901
SHA512 e4a0ea0345fd487bbdb96127f2394d2e20cb125b7b980ecc805d057eda984f72520fc4cd3f2bd424fe411c28ffdc159d8343199927ef1b43fe4a623027d3c204
SSDEEP 6144:3mjmIjsD85gYE9wsXcviaDIh/0LzlU5leOx7:3mjE8KVXcvNIh/5feOJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

suiwrm.exe

Path C:\Users\Admin\AppData\Local\Temp\suiwrm.exe
Size 343KB
SHA256 ea69b07706aba9a15016920d13f8683fa24adfa52dab58a784ca517d97305fce
MD5 9cbc0aeb69906cc4c5fb514703b33eeb
SHA1 8acdd4cb12e428c045387f728acf13b3a36594ec
SHA512 ef683a2ff916ba0e9e886df53600cacd337ebbf44f6d001ae1ab6cebe6912060320e82615b423398d724e5ddab821b6fe62e81b33e7d2b89c3033822e7740bb1
SSDEEP 6144:BLlaYjRu38mQFRcLKXLoGPhWl+eeivIj:Rltj08m2RcLat/1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

suiwrm.exe

Path C:\Users\Admin\AppData\Local\Temp\suiwrm.exe
Size 343KB
SHA256 ea69b07706aba9a15016920d13f8683fa24adfa52dab58a784ca517d97305fce
MD5 9cbc0aeb69906cc4c5fb514703b33eeb
SHA1 8acdd4cb12e428c045387f728acf13b3a36594ec
SHA512 ef683a2ff916ba0e9e886df53600cacd337ebbf44f6d001ae1ab6cebe6912060320e82615b423398d724e5ddab821b6fe62e81b33e7d2b89c3033822e7740bb1
SSDEEP 6144:BLlaYjRu38mQFRcLKXLoGPhWl+eeivIj:Rltj08m2RcLat/1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

suiwrm.exe

Path C:\Users\Admin\AppData\Local\Temp\suiwrm.exe
Size 343KB
SHA256 ea69b07706aba9a15016920d13f8683fa24adfa52dab58a784ca517d97305fce
MD5 9cbc0aeb69906cc4c5fb514703b33eeb
SHA1 8acdd4cb12e428c045387f728acf13b3a36594ec
SHA512 ef683a2ff916ba0e9e886df53600cacd337ebbf44f6d001ae1ab6cebe6912060320e82615b423398d724e5ddab821b6fe62e81b33e7d2b89c3033822e7740bb1
SSDEEP 6144:BLlaYjRu38mQFRcLKXLoGPhWl+eeivIj:Rltj08m2RcLat/1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

uutttbmda.p

Path C:\Users\Admin\AppData\Local\Temp\uutttbmda.p
Size 8KB
SHA256 5cea0f3c7bffb46ca1586f16b65e921d34135dd55f0d7da6bec06e9e71df83df
MD5 456389638368ef6dc51188f5edd163e1
SHA1 816da602c5362059d1bb387494e5e053d459ad95
SHA512 8a562fe8396e94b6b4ac2ec95de53808ed576b0d96140ab61066967a81f6483b94dd346b44a9ce4056276ca51e6fd1e91138fd8f71bcacc982583deeca77cc8b
SSDEEP 192:xmn7Wx+zl1ec8jEnllioShiacBKnrAuQ8AP7UHS:on7WQzl1ttrBKralPQHS
MD5 SHA1 SHA512 SSDEEP

Submit Download

suiwrm.exe

Path \Users\Admin\AppData\Local\Temp\suiwrm.exe
Size 343KB
SHA256 ea69b07706aba9a15016920d13f8683fa24adfa52dab58a784ca517d97305fce
MD5 9cbc0aeb69906cc4c5fb514703b33eeb
SHA1 8acdd4cb12e428c045387f728acf13b3a36594ec
SHA512 ef683a2ff916ba0e9e886df53600cacd337ebbf44f6d001ae1ab6cebe6912060320e82615b423398d724e5ddab821b6fe62e81b33e7d2b89c3033822e7740bb1
SSDEEP 6144:BLlaYjRu38mQFRcLKXLoGPhWl+eeivIj:Rltj08m2RcLat/1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

suiwrm.exe

Path \Users\Admin\AppData\Local\Temp\suiwrm.exe
Size 343KB
SHA256 ea69b07706aba9a15016920d13f8683fa24adfa52dab58a784ca517d97305fce
MD5 9cbc0aeb69906cc4c5fb514703b33eeb
SHA1 8acdd4cb12e428c045387f728acf13b3a36594ec
SHA512 ef683a2ff916ba0e9e886df53600cacd337ebbf44f6d001ae1ab6cebe6912060320e82615b423398d724e5ddab821b6fe62e81b33e7d2b89c3033822e7740bb1
SSDEEP 6144:BLlaYjRu38mQFRcLKXLoGPhWl+eeivIj:Rltj08m2RcLat/1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/560-67-0x0000000000290000-0x00000000002CC000-memory.dmp

Download

memory/560-68-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/740-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Download

memory/1172-65-0x0000000000180000-0x0000000000183000-memory.dmp

Download