agenttesla | 2d96512f33cd8445144d7e54a10372aee634560021661e5988ff503bbff094fd

General

Target

7c5e8174cdba01f663d435d1ea9d3c41.js
Size

374KB
MD5

2c18b9d4a4e1519c66e969e5296eb46d
SHA1

b2852a309cab8cf2315f1b9898c4209d63c617e7
SHA256

2d96512f33cd8445144d7e54a10372aee634560021661e5988ff503bbff094fd
SHA512

d2369695292d171792e4aa21a3ecaa60ad8068bca86aa9e275a387f14703ec1502be74e9169a94b1fb5a55a0c2f305dae59803b27d21ac734180be301e4a3942
SSDEEP

6144:Nw/VyURyDDckawASdoFoYbwXiC4gJMYSDnc3erU5B7LGfMzD:iy4xA4gJNSvgmfM/

Score

10^/10

agenttesla vjw0rm collection keylogger spyware stealer trojan worm

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5752794370:AAGHbBIUSUvwQW5dpdi3bNZyPbHwpEPD5r0/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 6 IoCs

Processes:

wscript.exe

flow pid process

5 5004 wscript.exe
16 5004 wscript.exe
33 5004 wscript.exe
47 5004 wscript.exe
51 5004 wscript.exe
65 5004 wscript.exe
Executes dropped EXE 1 IoCs

Processes:

RRRTTT.exe

pid process

4968 RRRTTT.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe

flow	pid	process
5	5004	wscript.exe
16	5004	wscript.exe
33	5004	wscript.exe
47	5004	wscript.exe
51	5004	wscript.exe
65	5004	wscript.exe

pid	process
4968	RRRTTT.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lGAgOfKqAd.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lGAgOfKqAd.js	wscript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RRRTTT.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RRRTTT.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RRRTTT.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RRRTTT.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 api.ipify.org
9 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RRRTTT.exe

pid process

4968 RRRTTT.exe
4968 RRRTTT.exe
4968 RRRTTT.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RRRTTT.exe

description pid process

Token: SeDebugPrivilege 4968 RRRTTT.exe

flow	ioc
8	api.ipify.org
9	api.ipify.org

pid	process
4968	RRRTTT.exe
4968	RRRTTT.exe
4968	RRRTTT.exe

description	pid	process
Token: SeDebugPrivilege	4968	RRRTTT.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4528 wrote to memory of 5004	4528	wscript.exe	wscript.exe
PID 4528 wrote to memory of 5004	4528	wscript.exe	wscript.exe
PID 4528 wrote to memory of 4968	4528	wscript.exe	RRRTTT.exe
PID 4528 wrote to memory of 4968	4528	wscript.exe	RRRTTT.exe
PID 4528 wrote to memory of 4968	4528	wscript.exe	RRRTTT.exe

outlook_office_path 1 IoCs

Processes:

RRRTTT.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RRRTTT.exe

outlook_win_path 1 IoCs

Processes:

RRRTTT.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RRRTTT.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\7c5e8174cdba01f663d435d1ea9d3c41.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lGAgOfKqAd.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
PID:5004

C:\Users\Admin\AppData\Roaming\RRRTTT.exe
"C:\Users\Admin\AppData\Roaming\RRRTTT.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\RRRTTT.exe
Filesize
196KB

MD5
cef584fa8a5b62e4ecb231b3a4ae17f6

SHA1
b913140c163cf97c6d50746ec6eef293bb4a2044

SHA256
c3062dae9f9438eef148f1e7518b7f10d7bbe294d6d60dd0c3c16058c8be5d41

SHA512
7d6f09d9bcf8abd1567a2477366226a888aaef6ce46df3a44761236c748a5960491f167f8f7c1d2f9feb8143956e9ca134d603431adcd80ea26811404deb6fc5

Download Submit
C:\Users\Admin\AppData\Roaming\RRRTTT.exe
Filesize
196KB

MD5
cef584fa8a5b62e4ecb231b3a4ae17f6

SHA1
b913140c163cf97c6d50746ec6eef293bb4a2044

SHA256
c3062dae9f9438eef148f1e7518b7f10d7bbe294d6d60dd0c3c16058c8be5d41

SHA512
7d6f09d9bcf8abd1567a2477366226a888aaef6ce46df3a44761236c748a5960491f167f8f7c1d2f9feb8143956e9ca134d603431adcd80ea26811404deb6fc5

Download Submit
C:\Users\Admin\AppData\Roaming\lGAgOfKqAd.js
Filesize
10KB

MD5
fa9d0f9f212317c220572faa7712088a

SHA1
d9e7d578de835f00ecf97b08b35f4f658cfa6438

SHA256
c42b2f4dbe43245dc08093394ff74dfb85ae95e2165f8cac39af88ae08eabfea

SHA512
8c133db7ef32a34ed2a0716022fdbdba4e334113d75376b851b908b3bc99dda8aced16533c79451ae5edfe964295a3ad03c853490de1af31a1968b04deaed7b8

Download Submit
memory/4968-134-0x0000000000000000-mapping.dmp

Download
memory/4968-137-0x0000000000940000-0x0000000000978000-memory.dmp

Filesize
224KB

Download
memory/4968-138-0x00000000058A0000-0x0000000005E44000-memory.dmp

Filesize
5.6MB

Download
memory/4968-139-0x0000000005390000-0x000000000542C000-memory.dmp

Filesize
624KB

Download
memory/4968-140-0x0000000005830000-0x0000000005896000-memory.dmp

Filesize
408KB

Download
memory/4968-141-0x0000000006AE0000-0x0000000006B30000-memory.dmp

Filesize
320KB

Download
memory/4968-142-0x0000000006C80000-0x0000000006D12000-memory.dmp

Filesize
584KB

Download
memory/4968-143-0x0000000006FB0000-0x0000000006FBA000-memory.dmp

Filesize
40KB

Download
memory/5004-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads