agenttesla | 4a5d563e7519d9b2e7321abc2aa2355ecb22ed8d60e34061a0f935757a6a0f82

General

Target

Consulta de compra.exe
Size

300.1MB
MD5

4a6c4f83ba59f169f41a77eed6d08fd3
SHA1

725e35e280c140840263b0a47d449b9e03e36942
SHA256

4a5d563e7519d9b2e7321abc2aa2355ecb22ed8d60e34061a0f935757a6a0f82
SHA512

2fe598182197d0f1ca7750ec9ff5ab15248a8611e6165a9449af30ca7fe206acff80a8bef179badf4100379dea18db8c94a3738bbf8c1847ec1b854159805c07
SSDEEP

192:jr0QjqirBzCL7eOIQSz16nbP3IwKu1AVxxlK4QzwU94aMVv0L:v0Q3rBWLmnz1MbvTKEAVk4QzwU9jA8L

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5954474519:AAEGnfW1mRvGRxq-zIAvwJfpKEbhLLiqVaM/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Consulta de compra.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Consulta de compra.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Consulta de compra.exe

description pid process target process

PID 692 set thread context of 4748 692 Consulta de compra.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exeInstallUtil.exe

pid process

3940 powershell.exe
3940 powershell.exe
212 powershell.exe
212 powershell.exe
4748 InstallUtil.exe
4748 InstallUtil.exe
4748 InstallUtil.exe

description	pid	process	target process
PID 692 set thread context of 4748	692	Consulta de compra.exe	InstallUtil.exe

pid	process
3940	powershell.exe
3940	powershell.exe
212	powershell.exe
212	powershell.exe
4748	InstallUtil.exe
4748	InstallUtil.exe
4748	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeConsulta de compra.exepowershell.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	692	Consulta de compra.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	4748	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Consulta de compra.exe

description	pid	process	target process
PID 692 wrote to memory of 3940	692	Consulta de compra.exe	powershell.exe
PID 692 wrote to memory of 3940	692	Consulta de compra.exe	powershell.exe
PID 692 wrote to memory of 3940	692	Consulta de compra.exe	powershell.exe
PID 692 wrote to memory of 212	692	Consulta de compra.exe	powershell.exe
PID 692 wrote to memory of 212	692	Consulta de compra.exe	powershell.exe
PID 692 wrote to memory of 212	692	Consulta de compra.exe	powershell.exe
PID 692 wrote to memory of 4748	692	Consulta de compra.exe	InstallUtil.exe
PID 692 wrote to memory of 4748	692	Consulta de compra.exe	InstallUtil.exe
PID 692 wrote to memory of 4748	692	Consulta de compra.exe	InstallUtil.exe
PID 692 wrote to memory of 4748	692	Consulta de compra.exe	InstallUtil.exe
PID 692 wrote to memory of 4748	692	Consulta de compra.exe	InstallUtil.exe
PID 692 wrote to memory of 4748	692	Consulta de compra.exe	InstallUtil.exe
PID 692 wrote to memory of 4748	692	Consulta de compra.exe	InstallUtil.exe
PID 692 wrote to memory of 4748	692	Consulta de compra.exe	InstallUtil.exe

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\Consulta de compra.exe
"C:\Users\Admin\AppData\Local\Temp\Consulta de compra.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-Date
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANwAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
8a765248a1362c87500c7a6bcbead9a5

SHA1
13e2f6fd3893d6ba9f45356b89b1f447d390aba6

SHA256
387afa0b32b5c8aab32cff6cb9e8366a40a84421eca1334a7ac638fefbc129fc

SHA512
df7961a57fcdac31191e30e9c3a3182b1c55e509c48e2f75f19f7fdd7c23c63ce4fd594c5f57ac69b3745ecb4ed8169afc83e461e0a5d15542f6eb1e05603a9f

Download Submit
memory/212-145-0x0000000000000000-mapping.dmp

Download
memory/692-141-0x0000000005010000-0x000000000501A000-memory.dmp

Filesize
40KB

Download
memory/692-133-0x0000000005120000-0x00000000056C4000-memory.dmp

Filesize
5.6MB

Download
memory/692-136-0x00000000057D0000-0x0000000005862000-memory.dmp

Filesize
584KB

Download
memory/692-132-0x00000000000D0000-0x00000000000E8000-memory.dmp

Filesize
96KB

Download
memory/3940-137-0x0000000004E50000-0x0000000005478000-memory.dmp

Filesize
6.2MB

Download
memory/3940-139-0x0000000005660000-0x00000000056C6000-memory.dmp

Filesize
408KB

Download
memory/3940-140-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/3940-142-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Filesize
120KB

Download
memory/3940-143-0x00000000074D0000-0x0000000007B4A000-memory.dmp

Filesize
6.5MB

Download
memory/3940-144-0x0000000006300000-0x000000000631A000-memory.dmp

Filesize
104KB

Download
memory/3940-138-0x0000000005580000-0x00000000055A2000-memory.dmp

Filesize
136KB

Download
memory/3940-135-0x00000000047D0000-0x0000000004806000-memory.dmp

Filesize
216KB

Download
memory/3940-134-0x0000000000000000-mapping.dmp

Download
memory/4748-148-0x0000000000000000-mapping.dmp

Download
memory/4748-149-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4748-150-0x0000000004F40000-0x0000000004FDC000-memory.dmp

Filesize
624KB

Download
memory/4748-151-0x0000000005FF0000-0x0000000006040000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads