agenttesla | ed4e50e4e27a56342352ddcf57ca038193ffb9332ae5f0f5551be1ed3463b04a

General

Target

hesaphareketi-01.pdf.exe
Size

409KB
MD5

40beb3ed7eadb05529230df2a8e5d53c
SHA1

7deab9b6bae7ce937d551077f1e7c276bdc48a42
SHA256

ed4e50e4e27a56342352ddcf57ca038193ffb9332ae5f0f5551be1ed3463b04a
SHA512

21f66e2a1c69262cd66a6bbe4aa52a9acdccbe99ef212e3d9e90e0dc6c5c5e2de491522b1ba681e720aa97a5044479e1b9687a8c8f34fe0f99648084881cd621
SSDEEP

6144:ukw2B9DAqHgpe4jYmfHMHLAdGqv/Lfn8l6VhiZppzdzkeS:ZZl4YmPMrAdbXzn8uiHhlkR

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 3 IoCs

pid	Process
2120	pfankuoeyw.exe
4876	pfankuoeyw.exe
4816	pfankuoeyw.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pfankuoeyw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pfankuoeyw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pfankuoeyw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fduh = "C:\\Users\\Admin\\AppData\\Roaming\\gryoysvslcrr\\etekfu.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\pfankuoeyw.exe\" C:\\Users\\Admin\\AppData\\L"	pfankuoeyw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2120 set thread context of 4816	2120	pfankuoeyw.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4816	pfankuoeyw.exe
4816	pfankuoeyw.exe
4816	pfankuoeyw.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2120	pfankuoeyw.exe
2120	pfankuoeyw.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	pfankuoeyw.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2120	4776	hesaphareketi-01.pdf.exe	82
PID 4776 wrote to memory of 2120	4776	hesaphareketi-01.pdf.exe	82
PID 4776 wrote to memory of 2120	4776	hesaphareketi-01.pdf.exe	82
PID 2120 wrote to memory of 4876	2120	pfankuoeyw.exe	83
PID 2120 wrote to memory of 4876	2120	pfankuoeyw.exe	83
PID 2120 wrote to memory of 4876	2120	pfankuoeyw.exe	83
PID 2120 wrote to memory of 4816	2120	pfankuoeyw.exe	84
PID 2120 wrote to memory of 4816	2120	pfankuoeyw.exe	84
PID 2120 wrote to memory of 4816	2120	pfankuoeyw.exe	84
PID 2120 wrote to memory of 4816	2120	pfankuoeyw.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pfankuoeyw.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pfankuoeyw.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe
  "C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe" C:\Users\Admin\AppData\Local\Temp\gdefr.i
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe
    "C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe"
    3⤵
    - Executes dropped EXE
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe
    "C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gdefr.i

Filesize
7KB

MD5
257e3a9907f470f2f4368b3ea5cb275e

SHA1
110aa67ab5dd3a8fed08dba7c4e0c6e46a6953ba

SHA256
dd3edf85aba7f052041f243973499a91b89b901770d97616f63583d861ef2c07

SHA512
ce281aa8d7d6411301ab77b9bf1c8550af9d78e92b49b7d020d766e74ef7d8dfe384b850f7c07bae1ec4f7ea27e7762dc26c9e9fc5241c1a99c2e776be94ee8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\olffx.se

Filesize
295KB

MD5
c981211a2c13586b98e868c8db913c47

SHA1
f735844b31455df39860191258740805fc412817

SHA256
b758db619d37316164b065f3ce1fc8ef04209c5df9546137d4521932d4450037

SHA512
30783b7dab7b81bf76a9c1ed4eb01919c2c7e190084affb41faefe7b7f574a1f93497a0a69a6f1e5ec31279ba95bb085a115d8c7aa6b5a05aaf18a3875948441

Download Submit
C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe

Filesize
128KB

MD5
c41c981699c42e3b6b1ef84aa5ffbaa9

SHA1
0ad98fbe88f47efdf73ee43c4f9b786adaa90aa9

SHA256
2f8cea8d0855d5b898a2bc07cbd5368b6a00b5aa88306d994f1be4173118e73f

SHA512
7da927e9f8368a2be92ed9974ef5a77c8fcbd84aed41d7b584128c2bff1f11284170a9782893250e1a318aa1e05695ce35c5b5a799d0ddee4fe6da4ee6b4993d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe

Filesize
128KB

MD5
c41c981699c42e3b6b1ef84aa5ffbaa9

SHA1
0ad98fbe88f47efdf73ee43c4f9b786adaa90aa9

SHA256
2f8cea8d0855d5b898a2bc07cbd5368b6a00b5aa88306d994f1be4173118e73f

SHA512
7da927e9f8368a2be92ed9974ef5a77c8fcbd84aed41d7b584128c2bff1f11284170a9782893250e1a318aa1e05695ce35c5b5a799d0ddee4fe6da4ee6b4993d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe

Filesize
128KB

MD5
c41c981699c42e3b6b1ef84aa5ffbaa9

SHA1
0ad98fbe88f47efdf73ee43c4f9b786adaa90aa9

SHA256
2f8cea8d0855d5b898a2bc07cbd5368b6a00b5aa88306d994f1be4173118e73f

SHA512
7da927e9f8368a2be92ed9974ef5a77c8fcbd84aed41d7b584128c2bff1f11284170a9782893250e1a318aa1e05695ce35c5b5a799d0ddee4fe6da4ee6b4993d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pfankuoeyw.exe

Filesize
128KB

MD5
c41c981699c42e3b6b1ef84aa5ffbaa9

SHA1
0ad98fbe88f47efdf73ee43c4f9b786adaa90aa9

SHA256
2f8cea8d0855d5b898a2bc07cbd5368b6a00b5aa88306d994f1be4173118e73f

SHA512
7da927e9f8368a2be92ed9974ef5a77c8fcbd84aed41d7b584128c2bff1f11284170a9782893250e1a318aa1e05695ce35c5b5a799d0ddee4fe6da4ee6b4993d

Download Submit
memory/4816-141-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4816-142-0x0000000005F30000-0x00000000064D4000-memory.dmp

Filesize
5.6MB

Download
memory/4816-143-0x0000000005980000-0x0000000005A1C000-memory.dmp

Filesize
624KB

Download
memory/4816-144-0x00000000068E0000-0x0000000006946000-memory.dmp

Filesize
408KB

Download
memory/4816-145-0x0000000006AD0000-0x0000000006B20000-memory.dmp

Filesize
320KB

Download
memory/4816-146-0x0000000006C70000-0x0000000006D02000-memory.dmp

Filesize
584KB

Download
memory/4816-147-0x0000000006F50000-0x0000000006F5A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing