agenttesla | 9dfdb5048599b1083fe534cf5fe5a0440d71eb74b5497e506f0a0a4c23821f40

General

Target

shipping docs.exe
Size

592KB
MD5

6308ae755a893c15a989b1ccf2c56393
SHA1

00ada70aa14a5cf26a7f8cecbaaa437267d30a2a
SHA256

9dfdb5048599b1083fe534cf5fe5a0440d71eb74b5497e506f0a0a4c23821f40
SHA512

e03eac82bf4174912d63cb8eceed393320fe957f7a735ff0f720fbf558f9638e6fc051cb80607864caaa8366ca0edc2d44028367ef97d8020ad7b6f45eaddcd3
SSDEEP

12288:ks2kzrbETClbHskFgFwIyXCDl+s30ki9Pi00uSGD6DWzEH:1176ChskFgqIyXoi9Pi00uSTHH

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

shipping docs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping docs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping docs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping docs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

shipping docs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\VMqTMMD = "C:\\Users\\Admin\\AppData\\Roaming\\VMqTMMD\\VMqTMMD.exe"	shipping docs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

shipping docs.exe

description pid process target process

PID 1240 set thread context of 2008 1240 shipping docs.exe shipping docs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1552 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

shipping docs.exeshipping docs.exe

pid process

1240 shipping docs.exe
1240 shipping docs.exe
1240 shipping docs.exe
2008 shipping docs.exe
2008 shipping docs.exe
2008 shipping docs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

shipping docs.exeshipping docs.exe

description pid process

Token: SeDebugPrivilege 1240 shipping docs.exe
Token: SeDebugPrivilege 2008 shipping docs.exe

description	pid	process	target process
PID 1240 set thread context of 2008	1240	shipping docs.exe	shipping docs.exe

pid	process
1552	schtasks.exe

pid	process
1240	shipping docs.exe
1240	shipping docs.exe
1240	shipping docs.exe
2008	shipping docs.exe
2008	shipping docs.exe
2008	shipping docs.exe

description	pid	process
Token: SeDebugPrivilege	1240	shipping docs.exe
Token: SeDebugPrivilege	2008	shipping docs.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

shipping docs.exe

description	pid	process	target process
PID 1240 wrote to memory of 1552	1240	shipping docs.exe	schtasks.exe
PID 1240 wrote to memory of 1552	1240	shipping docs.exe	schtasks.exe
PID 1240 wrote to memory of 1552	1240	shipping docs.exe	schtasks.exe
PID 1240 wrote to memory of 1552	1240	shipping docs.exe	schtasks.exe
PID 1240 wrote to memory of 1288	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 1288	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 1288	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 1288	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 328	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 328	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 328	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 328	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe
PID 1240 wrote to memory of 2008	1240	shipping docs.exe	shipping docs.exe

outlook_office_path 1 IoCs

Processes:

shipping docs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping docs.exe

outlook_win_path 1 IoCs

Processes:

shipping docs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping docs.exe

C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
"C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA7F.tmp"
2⤵
- Creates scheduled task(s)
PID:1552

C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
"{path}"
2⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
"{path}"
2⤵
PID:328

C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2008

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEA7F.tmp
Filesize
1KB

MD5
66ab18796e0e8455dc6865d1aa9b434c

SHA1
a569cc3baf98499c2f439fa8e26b2068a5c10d80

SHA256
de8eadfeac91165c7206c0d7f865fef3b55397449bd4bb109ff7124a77c621df

SHA512
6c5d2772e29f4bb5832b92767d2e4340a9e74abb6aa74ba9c69b99f20e8809a571bffaf22f9e7708ebc3e450af1a853d05b06e88a4d592d08be577e39b02463f

Download Submit
memory/1240-57-0x0000000005280000-0x0000000005304000-memory.dmp

Filesize
528KB

Download
memory/1240-56-0x0000000000320000-0x0000000000332000-memory.dmp

Filesize
72KB

Download
memory/1240-54-0x00000000011B0000-0x000000000124A000-memory.dmp

Filesize
616KB

Download
memory/1240-58-0x00000000007A0000-0x00000000007DC000-memory.dmp

Filesize
240KB

Download
memory/1240-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1552-59-0x0000000000000000-mapping.dmp

Download
memory/2008-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-67-0x0000000000437C1E-mapping.dmp

Download
memory/2008-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads