agenttesla | 59e009667dbb1344d0639b171763fe0d79b27e4419df4ee9829b7789197cc6e4

General

Target

PO_4500003061 signed copy.exe
Size

880KB
MD5

9bd1c9256c64814f6c83e3a76f60c42c
SHA1

b7867985ca8a61d942e82a021e27b9dbea5c0b42
SHA256

59e009667dbb1344d0639b171763fe0d79b27e4419df4ee9829b7789197cc6e4
SHA512

ec602de86a0eaf3472a2bade71d66b05e3fb833a14392baae9bf699a46aebbd8c2892cea2ecca9ec8b79d3a68a6f86c43bf267888bc83607fecd40bbf24fa102
SSDEEP

24576:mvH2Mj6pEyFxCUVZHp24gBxIKH9zPlESv:mvWMu6yFVVxp24gBzRP+Sv

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.saudlunion.com
Port:
587
Username:
[email protected]
Password:
QkOo#D#4

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

PO_4500003061 signed copy.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO_4500003061 signed copy.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO_4500003061 signed copy.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO_4500003061 signed copy.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO_4500003061 signed copy.exe

description pid process target process

PID 892 set thread context of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

828 schtasks.exe

description	pid	process	target process
PID 892 set thread context of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe

pid	process
828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

PO_4500003061 signed copy.exePO_4500003061 signed copy.exepowershell.exe

pid	process
892	PO_4500003061 signed copy.exe
892	PO_4500003061 signed copy.exe
892	PO_4500003061 signed copy.exe
892	PO_4500003061 signed copy.exe
892	PO_4500003061 signed copy.exe
892	PO_4500003061 signed copy.exe
892	PO_4500003061 signed copy.exe
892	PO_4500003061 signed copy.exe
892	PO_4500003061 signed copy.exe
1692	PO_4500003061 signed copy.exe
1692	PO_4500003061 signed copy.exe
572	powershell.exe
1692	PO_4500003061 signed copy.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PO_4500003061 signed copy.exePO_4500003061 signed copy.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	892	PO_4500003061 signed copy.exe
Token: SeDebugPrivilege	1692	PO_4500003061 signed copy.exe
Token: SeDebugPrivilege	572	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

PO_4500003061 signed copy.exe

description	pid	process	target process
PID 892 wrote to memory of 572	892	PO_4500003061 signed copy.exe	powershell.exe
PID 892 wrote to memory of 572	892	PO_4500003061 signed copy.exe	powershell.exe
PID 892 wrote to memory of 572	892	PO_4500003061 signed copy.exe	powershell.exe
PID 892 wrote to memory of 572	892	PO_4500003061 signed copy.exe	powershell.exe
PID 892 wrote to memory of 828	892	PO_4500003061 signed copy.exe	schtasks.exe
PID 892 wrote to memory of 828	892	PO_4500003061 signed copy.exe	schtasks.exe
PID 892 wrote to memory of 828	892	PO_4500003061 signed copy.exe	schtasks.exe
PID 892 wrote to memory of 828	892	PO_4500003061 signed copy.exe	schtasks.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe
PID 892 wrote to memory of 1692	892	PO_4500003061 signed copy.exe	PO_4500003061 signed copy.exe

outlook_office_path 1 IoCs

Processes:

PO_4500003061 signed copy.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO_4500003061 signed copy.exe

outlook_win_path 1 IoCs

Processes:

PO_4500003061 signed copy.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO_4500003061 signed copy.exe

C:\Users\Admin\AppData\Local\Temp\PO_4500003061 signed copy.exe
"C:\Users\Admin\AppData\Local\Temp\PO_4500003061 signed copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hCAyCw.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hCAyCw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp538D.tmp"
2⤵
- Creates scheduled task(s)
PID:828

C:\Users\Admin\AppData\Local\Temp\PO_4500003061 signed copy.exe
"C:\Users\Admin\AppData\Local\Temp\PO_4500003061 signed copy.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp538D.tmp
Filesize
1KB

MD5
7b59fc9e685d9b21a4833c741af20bdc

SHA1
2c539046dc4f19c7216924c6199584a9120e7f0e

SHA256
d5f7018b13010c8fe6bbbda708fddc23e909e5b32c7b593d140d74b14383b372

SHA512
4f4bf7d696b3f9a8ce40c60ad560d50d08f17d4058cf7ff381646f1c69113c564f24c7fa2fbd3ff01688f354c57ae50b71c594e2304ba61484b32d451a931583

Download Submit
memory/572-59-0x0000000000000000-mapping.dmp

Download
memory/572-77-0x000000006EE60000-0x000000006F40B000-memory.dmp

Filesize
5.7MB

Download
memory/572-76-0x000000006EE60000-0x000000006F40B000-memory.dmp

Filesize
5.7MB

Download
memory/828-61-0x0000000000000000-mapping.dmp

Download
memory/892-63-0x0000000007EC0000-0x0000000007F1C000-memory.dmp

Filesize
368KB

Download
memory/892-58-0x0000000005E60000-0x0000000005EF6000-memory.dmp

Filesize
600KB

Download
memory/892-57-0x0000000000510000-0x000000000051E000-memory.dmp

Filesize
56KB

Download
memory/892-54-0x0000000000EA0000-0x0000000000F82000-memory.dmp

Filesize
904KB

Download
memory/892-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/892-56-0x00000000004F0000-0x0000000000506000-memory.dmp

Filesize
88KB

Download
memory/1692-68-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1692-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1692-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1692-70-0x000000000043243E-mapping.dmp

Download
memory/1692-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1692-74-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1692-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1692-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads