agenttesla | 8e286696a68fbea67a45b8b49daf8d6b486340d6515a19255f57b42b9a3c053d

General

Target

1992-72-0x0000000000400000-0x000000000043D000-memory.exe
Size

244KB
MD5

eafd1bff062f8edb0ed644c3a6bd5d65
SHA1

cdc15a5eedf87e2c6ec547f24e833b8ccf1b0cc1
SHA256

8e286696a68fbea67a45b8b49daf8d6b486340d6515a19255f57b42b9a3c053d
SHA512

552f7ac2d6c8c037fcbc81d968e6e41517eb95e0bdc35d7b4c2525279e17d31cd62d02e675d1406b345b90809d9837a68de05103ace766d266c52cb9e3fc4ed5
SSDEEP

3072:AHWG7oJ4jT1Yto2mAFPlfT0bxzbUKOfeNUY2jzkRhXJwXJ0yeGrptQY3FXJzNvG5:A2GPTC59E1Uffe+Y2chX2XciJVXFNvI

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

http://107.189.4.253/zipone/inc/10c5bcaaef047d.php

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 3 IoCs

Processes:

FB_887E.tmp.exeFB_D1AD.tmp.exesvcupdater.exe

pid process

3840 FB_887E.tmp.exe
3760 FB_D1AD.tmp.exe
4056 svcupdater.exe

pid	process
3840	FB_887E.tmp.exe
3760	FB_D1AD.tmp.exe
4056	svcupdater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1992-72-0x0000000000400000-0x000000000043D000-memory.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1992-72-0x0000000000400000-0x000000000043D000-memory.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

FB_887E.tmp.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	FB_887E.tmp.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	FB_887E.tmp.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	FB_887E.tmp.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4764 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

FB_887E.tmp.exe

pid process

3840 FB_887E.tmp.exe
3840 FB_887E.tmp.exe
3840 FB_887E.tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

FB_887E.tmp.exesvcupdater.exe

description pid process

Token: SeDebugPrivilege 3840 FB_887E.tmp.exe
Token: SeDebugPrivilege 4056 svcupdater.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

FB_887E.tmp.exe

pid process

3840 FB_887E.tmp.exe

flow	ioc
17	api.ipify.org

pid	process
4764	schtasks.exe

pid	process
3840	FB_887E.tmp.exe
3840	FB_887E.tmp.exe
3840	FB_887E.tmp.exe

description	pid	process
Token: SeDebugPrivilege	3840	FB_887E.tmp.exe
Token: SeDebugPrivilege	4056	svcupdater.exe

pid	process
3840	FB_887E.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1992-72-0x0000000000400000-0x000000000043D000-memory.exeFB_D1AD.tmp.execmd.exe

description	pid	process	target process
PID 4468 wrote to memory of 3840	4468	1992-72-0x0000000000400000-0x000000000043D000-memory.exe	FB_887E.tmp.exe
PID 4468 wrote to memory of 3840	4468	1992-72-0x0000000000400000-0x000000000043D000-memory.exe	FB_887E.tmp.exe
PID 4468 wrote to memory of 3840	4468	1992-72-0x0000000000400000-0x000000000043D000-memory.exe	FB_887E.tmp.exe
PID 4468 wrote to memory of 3760	4468	1992-72-0x0000000000400000-0x000000000043D000-memory.exe	FB_D1AD.tmp.exe
PID 4468 wrote to memory of 3760	4468	1992-72-0x0000000000400000-0x000000000043D000-memory.exe	FB_D1AD.tmp.exe
PID 3760 wrote to memory of 4508	3760	FB_D1AD.tmp.exe	cmd.exe
PID 3760 wrote to memory of 4508	3760	FB_D1AD.tmp.exe	cmd.exe
PID 4508 wrote to memory of 4764	4508	cmd.exe	schtasks.exe
PID 4508 wrote to memory of 4764	4508	cmd.exe	schtasks.exe

outlook_office_path 1 IoCs

Processes:

FB_887E.tmp.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	FB_887E.tmp.exe

outlook_win_path 1 IoCs

Processes:

FB_887E.tmp.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	FB_887E.tmp.exe

C:\Users\Admin\AppData\Local\Temp\1992-72-0x0000000000400000-0x000000000043D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1992-72-0x0000000000400000-0x000000000043D000-memory.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4468

C:\Users\Admin\AppData\Local\Temp\FB_887E.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_887E.tmp.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3840

C:\Users\Admin\AppData\Local\Temp\FB_D1AD.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_D1AD.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C schtasks /create /tn \oflgwXquKB /tr "C:\Users\Admin\AppData\Roaming\oflgwXquKB\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
3⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\system32\schtasks.exe
schtasks /create /tn \oflgwXquKB /tr "C:\Users\Admin\AppData\Roaming\oflgwXquKB\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
4⤵
- Creates scheduled task(s)
PID:4764

C:\Users\Admin\AppData\Roaming\oflgwXquKB\svcupdater.exe
C:\Users\Admin\AppData\Roaming\oflgwXquKB\svcupdater.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FB_887E.tmp.exe

Filesize
217KB

MD5
9b806fd0bd716d762711c47fdc887783

SHA1
2881e1da525b16b7c5b8178d7c6c12613983dbda

SHA256
475caa3046685bdfb65538f4a4467b6ce115936736ffce85307da0fcaa55cec7

SHA512
4d898500cd2205fc7701556e22f284b2d47a482c152625123136881471962a0e646172a0364d55d74902f09dbcaf4699a901a7c81ccdd3e419796dab088e6f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_887E.tmp.exe

Filesize
217KB

MD5
9b806fd0bd716d762711c47fdc887783

SHA1
2881e1da525b16b7c5b8178d7c6c12613983dbda

SHA256
475caa3046685bdfb65538f4a4467b6ce115936736ffce85307da0fcaa55cec7

SHA512
4d898500cd2205fc7701556e22f284b2d47a482c152625123136881471962a0e646172a0364d55d74902f09dbcaf4699a901a7c81ccdd3e419796dab088e6f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_D1AD.tmp.exe

Filesize
8KB

MD5
fa22ef17a3b0bdb50020d4f27ad2feec

SHA1
634ecd4159890f24dce98a71b39a86ffdfd207bd

SHA256
81aa7692e1e20c72d05efa7fcde837f4306a6c95798d49acf734fff49015fc1c

SHA512
fc5e6d9e61df6d5c54a73e44e9a8f82a0df6006d7ab60b1a1199928df6eaf46610d4db53ce18fba84de4b93b29ff23fd17fe4d3d3b9d3afbf44ba65478c89408

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_D1AD.tmp.exe

Filesize
8KB

MD5
fa22ef17a3b0bdb50020d4f27ad2feec

SHA1
634ecd4159890f24dce98a71b39a86ffdfd207bd

SHA256
81aa7692e1e20c72d05efa7fcde837f4306a6c95798d49acf734fff49015fc1c

SHA512
fc5e6d9e61df6d5c54a73e44e9a8f82a0df6006d7ab60b1a1199928df6eaf46610d4db53ce18fba84de4b93b29ff23fd17fe4d3d3b9d3afbf44ba65478c89408

Download Submit
C:\Users\Admin\AppData\Roaming\oflgwXquKB\svcupdater.exe

Filesize
435.5MB

MD5
e6297410189db5320d43d75e8570d327

SHA1
22f359bc9575ed508633f3de4f177bcacd423922

SHA256
2aad48c6a7eca3fe93716745c9bbb6d4e03c640dea055fac92d633a0d8a8e105

SHA512
0aa56a3c2e13e2c812f1773e34996a7be1b7d792d3cc276e1189883b82389cf13182fe4b072b7d7426645fc9e3df73d9dc463f7a6103ab4b0284b6420ad4b1ba

Download Submit
C:\Users\Admin\AppData\Roaming\oflgwXquKB\svcupdater.exe

Filesize
435.3MB

MD5
5e0c01e1e09a1df200df558d99da90ed

SHA1
048b21549132c2450d07368c4d35d0380bb671ac

SHA256
0dcfb74668fcb075cd9161195d507423cf6d7a6d381ebae1334a4d3ee837bfda

SHA512
ca9921a0ac46fb7232f71e2314eb345d4a315be337b7fbc3bab0405640960c4da33512c7a7d51e06c7ffe7404bd2f9fa65c20c702e10b400e40295e01e44709a

Download Submit
memory/3760-143-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/3760-135-0x0000000000000000-mapping.dmp

Download
memory/3760-138-0x0000000000A80000-0x0000000000A88000-memory.dmp

Filesize
32KB

Download
memory/3760-139-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/3840-140-0x00000000733A0000-0x0000000073951000-memory.dmp

Filesize
5.7MB

Download
memory/3840-144-0x00000000733A0000-0x0000000073951000-memory.dmp

Filesize
5.7MB

Download
memory/3840-132-0x0000000000000000-mapping.dmp

Download
memory/4056-147-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/4056-148-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/4508-141-0x0000000000000000-mapping.dmp

Download
memory/4764-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads