agenttesla | 9f04b0b059e331845f8c3f9f4f83c785b07766529bb24dbbfb02fbab9e414938

General

Target

statement of account.exe
Size

759KB
MD5

808f76963a9f42ad7310a3b7d65c7983
SHA1

f748a841b2ec35bc40ed0bacbe953c28bc11a8a6
SHA256

9f04b0b059e331845f8c3f9f4f83c785b07766529bb24dbbfb02fbab9e414938
SHA512

33681149a92fa03e80ed0e1c38dac6672785dd058d40b74daa75f649d8b7b78b315755fe81854919579a4fd9c1043aa52bcc5a46a3ccc954c1e6d3c16ea9a5cb
SSDEEP

12288:nKdsyGFr5cE8LHW4RelEpb8bOmsX4K1hOCcTVURwq05Sgk2/SEdRMA/LyzIPPPu:6ZvLrRGWb8OH1hO1UH0A49/LkInstA

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.clipjoint.co.nz
Port:
587
Username:
clipjoint@clipjoint.co.nz
Password:
melandloz64
Email To:
geortiok4@gmail.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Drops file in Drivers directory 1 IoCs

Processes:

statement of account.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts statement of account.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	statement of account.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

statement of account.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	statement of account.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

statement of account.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	statement of account.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	statement of account.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	statement of account.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

statement of account.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LIhMQ = "C:\\Users\\Admin\\AppData\\Roaming\\LIhMQ\\LIhMQ.exe"	statement of account.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

statement of account.exe

description pid process target process

PID 2224 set thread context of 4592 2224 statement of account.exe statement of account.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1000 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

statement of account.exestatement of account.exe

pid process

2224 statement of account.exe
4592 statement of account.exe
4592 statement of account.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

statement of account.exestatement of account.exe

description pid process

Token: SeDebugPrivilege 2224 statement of account.exe
Token: SeDebugPrivilege 4592 statement of account.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

statement of account.exe

pid process

4592 statement of account.exe

description	pid	process	target process
PID 2224 set thread context of 4592	2224	statement of account.exe	statement of account.exe

pid	process
1000	schtasks.exe

pid	process
2224	statement of account.exe
4592	statement of account.exe
4592	statement of account.exe

description	pid	process
Token: SeDebugPrivilege	2224	statement of account.exe
Token: SeDebugPrivilege	4592	statement of account.exe

pid	process
4592	statement of account.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

statement of account.exe

description	pid	process	target process
PID 2224 wrote to memory of 1000	2224	statement of account.exe	schtasks.exe
PID 2224 wrote to memory of 1000	2224	statement of account.exe	schtasks.exe
PID 2224 wrote to memory of 1000	2224	statement of account.exe	schtasks.exe
PID 2224 wrote to memory of 4592	2224	statement of account.exe	statement of account.exe
PID 2224 wrote to memory of 4592	2224	statement of account.exe	statement of account.exe
PID 2224 wrote to memory of 4592	2224	statement of account.exe	statement of account.exe
PID 2224 wrote to memory of 4592	2224	statement of account.exe	statement of account.exe
PID 2224 wrote to memory of 4592	2224	statement of account.exe	statement of account.exe
PID 2224 wrote to memory of 4592	2224	statement of account.exe	statement of account.exe
PID 2224 wrote to memory of 4592	2224	statement of account.exe	statement of account.exe
PID 2224 wrote to memory of 4592	2224	statement of account.exe	statement of account.exe

outlook_office_path 1 IoCs

Processes:

statement of account.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	statement of account.exe

outlook_win_path 1 IoCs

Processes:

statement of account.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	statement of account.exe

C:\Users\Admin\AppData\Local\Temp\statement of account.exe
"C:\Users\Admin\AppData\Local\Temp\statement of account.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LtdekfbHULJt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4035.tmp"
2⤵
- Creates scheduled task(s)
PID:1000

C:\Users\Admin\AppData\Local\Temp\statement of account.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\statement of account.exe.log
Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4035.tmp
Filesize
1KB

MD5
8bfe24d18c98662dec9160a47643d055

SHA1
6f0a0ac9e60b6b884eaad2f34bae50f780f7acd0

SHA256
b265cb59670c6e0ed564919ec9825d32dffd1f24b3447695fd383aaa0715bb97

SHA512
3f4305da38ea3585341042d24b4ffe54a01965bf9cc1a4cee762a470eee75d20c79288acbc7e09d28886b4e546f34f51847496aa6bbed2fdbd3c305a75807534

Download Submit
memory/1000-137-0x0000000000000000-mapping.dmp

Download
memory/2224-132-0x0000000000E90000-0x0000000000F54000-memory.dmp

Filesize
784KB

Download
memory/2224-133-0x0000000005E10000-0x00000000063B4000-memory.dmp

Filesize
5.6MB

Download
memory/2224-134-0x0000000005900000-0x0000000005992000-memory.dmp

Filesize
584KB

Download
memory/2224-135-0x0000000005A40000-0x0000000005ADC000-memory.dmp

Filesize
624KB

Download
memory/2224-136-0x00000000058F0000-0x00000000058FA000-memory.dmp

Filesize
40KB

Download
memory/4592-139-0x0000000000000000-mapping.dmp

Download
memory/4592-140-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4592-142-0x00000000064A0000-0x0000000006506000-memory.dmp

Filesize
408KB

Download
memory/4592-143-0x0000000006AD0000-0x0000000006B20000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads