agenttesla | 13838a56d0a201699cd999fdfea7450d09bce9f89db3dbd1ae0c007367daae82

General

Target

SWIFT_EU.exe
Size

1017KB
MD5

0bb87df8b4cc8098bae7d574c201d60f
SHA1

303518f8ee040aea50f9f9958294e315aec6cf77
SHA256

d2ca24f7ef22dfa8be6dc45ba0a64350d668bd0b9fb5a7be7d82305313d404bf
SHA512

9a11b65f91c0e561be42e1880336115ecb025acaff0e34ee13799215489e44f0ac648c6a92882a5ccb4c3d4385e4aa3adca7f6e9883248597e0a9490d4af6373
SSDEEP

24576:VDgh/8zhJB6YuuWtE4gNHL6YxMTmuxnH2t:Vch/8lz6YN5PxcH2t

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mad-max.pila.pl
Port:
587
Username:
[email protected]
Password:
JCbDYyer
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

SWIFT_EU.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT_EU.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT_EU.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT_EU.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT_EU.exe

description pid process target process

PID 1948 set thread context of 812 1948 SWIFT_EU.exe SWIFT_EU.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1236 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exeSWIFT_EU.exe

pid process

1768 powershell.exe
992 powershell.exe
812 SWIFT_EU.exe
812 SWIFT_EU.exe
812 SWIFT_EU.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

SWIFT_EU.exe

pid process

812 SWIFT_EU.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SWIFT_EU.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 812 SWIFT_EU.exe
Token: SeDebugPrivilege 992 powershell.exe
Token: SeDebugPrivilege 1768 powershell.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 1948 set thread context of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe

pid	process
1236	schtasks.exe

pid	process
1768	powershell.exe
992	powershell.exe
812	SWIFT_EU.exe
812	SWIFT_EU.exe
812	SWIFT_EU.exe

pid	process
812	SWIFT_EU.exe

description	pid	process
Token: SeDebugPrivilege	812	SWIFT_EU.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

SWIFT_EU.exe

description	pid	process	target process
PID 1948 wrote to memory of 1768	1948	SWIFT_EU.exe	powershell.exe
PID 1948 wrote to memory of 1768	1948	SWIFT_EU.exe	powershell.exe
PID 1948 wrote to memory of 1768	1948	SWIFT_EU.exe	powershell.exe
PID 1948 wrote to memory of 1768	1948	SWIFT_EU.exe	powershell.exe
PID 1948 wrote to memory of 992	1948	SWIFT_EU.exe	powershell.exe
PID 1948 wrote to memory of 992	1948	SWIFT_EU.exe	powershell.exe
PID 1948 wrote to memory of 992	1948	SWIFT_EU.exe	powershell.exe
PID 1948 wrote to memory of 992	1948	SWIFT_EU.exe	powershell.exe
PID 1948 wrote to memory of 1236	1948	SWIFT_EU.exe	schtasks.exe
PID 1948 wrote to memory of 1236	1948	SWIFT_EU.exe	schtasks.exe
PID 1948 wrote to memory of 1236	1948	SWIFT_EU.exe	schtasks.exe
PID 1948 wrote to memory of 1236	1948	SWIFT_EU.exe	schtasks.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe
PID 1948 wrote to memory of 812	1948	SWIFT_EU.exe	SWIFT_EU.exe

outlook_office_path 1 IoCs

Processes:

SWIFT_EU.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT_EU.exe

outlook_win_path 1 IoCs

Processes:

SWIFT_EU.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT_EU.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT_EU.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT_EU.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SWIFT_EU.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mnshYts.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mnshYts" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB359.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\SWIFT_EU.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT_EU.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB359.tmp

Filesize
1KB

MD5
fd32bbb2e9a0cb33f3860d02d487cab1

SHA1
401b514f4a36865118e77abeb34208aade8ade88

SHA256
1063c4f3cc432233a305f876fa6f58e021ec9787d659566f3d643c253e9e9b10

SHA512
3d7046bb66e733034bef773dbaeb10ec6b395317d769f03ae002f011a51f357c1ae91e2407f0a2d325f425ec96b0de65e2f8a2e7d8440c098bb1ddf9a9718eb3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
341b6faf35745963a2423d3b6432c578

SHA1
1bc7a0e76f4cae66d00791c62c184847ac2e6c9c

SHA256
236081eed26fae686648b3c9051ac8fd03d1589277deb616ef82b785da65a017

SHA512
7192aed41dd7e8fb023c55df917c23effa86ee4ec5106595d70b831112c0d374b9e5ddbc27c19678339f985fad3f37c6e40a8128b575525b30825644c5cf1734

Download Submit
memory/812-77-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/812-72-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/812-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/812-75-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/812-73-0x0000000000437C8E-mapping.dmp

Download
memory/812-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/812-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/812-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/992-82-0x000000006D7F0000-0x000000006DD9B000-memory.dmp

Filesize
5.7MB

Download
memory/992-83-0x000000006D7F0000-0x000000006DD9B000-memory.dmp

Filesize
5.7MB

Download
memory/992-61-0x0000000000000000-mapping.dmp

Download
memory/992-80-0x000000006D7F0000-0x000000006DD9B000-memory.dmp

Filesize
5.7MB

Download
memory/1236-62-0x0000000000000000-mapping.dmp

Download
memory/1768-84-0x000000006D7F0000-0x000000006DD9B000-memory.dmp

Filesize
5.7MB

Download
memory/1768-81-0x000000006D7F0000-0x000000006DD9B000-memory.dmp

Filesize
5.7MB

Download
memory/1768-79-0x000000006D7F0000-0x000000006DD9B000-memory.dmp

Filesize
5.7MB

Download
memory/1768-59-0x0000000000000000-mapping.dmp

Download
memory/1948-56-0x0000000000580000-0x0000000000596000-memory.dmp

Filesize
88KB

Download
memory/1948-54-0x0000000000170000-0x0000000000274000-memory.dmp

Filesize
1.0MB

Download
memory/1948-58-0x0000000005F50000-0x0000000005FE8000-memory.dmp

Filesize
608KB

Download
memory/1948-66-0x0000000004E20000-0x0000000004E80000-memory.dmp

Filesize
384KB

Download
memory/1948-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1948-57-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads