agenttesla | b3271cac975a34320b8dd67850d535e5ef96651e3371356cf3ec7cfca34a3caf

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/12/2022, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe
Size 242KB
Sample221219-e5dneaec26
SHA256 b3271cac975a34320b8dd67850d535e5ef96651e3371356cf3ec7cfca34a3caf
MD5 c501da741daaf9b168d69702ab31ef72
SHA1 16937fc3f7e3f22ba17ad14991af5db5100ce56f
SHA512 f629b2ca91fe4899906a12f911deb53220cc4b3d934c64200c8c36d481e4dc5eae1b65696e12125e97a60019cb72bc32470affc78d24b411a699062335c5cf41
SSDEEP 6144:LkwTEnOTyRalNKYTTd5m4fVnGUk3zk15diz/G:6OTyRal8GTSwz3ia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.oswaldbro.co.za
Port
587
Username
[email protected]
Password
OrdersOSB$
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2040	zbnqmo.exe
1292	zbnqmo.exe

Loads dropped DLL 3 IoCs

pid	Process
1784	SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe
1784	SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe
2040	zbnqmo.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zbnqmo.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zbnqmo.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zbnqmo.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1292	2040	zbnqmo.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1292	zbnqmo.exe
1292	zbnqmo.exe
1292	zbnqmo.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2040	zbnqmo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	zbnqmo.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2040	1784	SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe	28
PID 1784 wrote to memory of 2040	1784	SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe	28
PID 1784 wrote to memory of 2040	1784	SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe	28
PID 1784 wrote to memory of 2040	1784	SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe	28
PID 2040 wrote to memory of 1292	2040	zbnqmo.exe	29
PID 2040 wrote to memory of 1292	2040	zbnqmo.exe	29
PID 2040 wrote to memory of 1292	2040	zbnqmo.exe	29
PID 2040 wrote to memory of 1292	2040	zbnqmo.exe	29
PID 2040 wrote to memory of 1292	2040	zbnqmo.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zbnqmo.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zbnqmo.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\zbnqmo.exe
  "C:\Users\Admin\AppData\Local\Temp\zbnqmo.exe" C:\Users\Admin\AppData\Local\Temp\fbylzbe.zt
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zbnqmo.exe
    "C:\Users\Admin\AppData\Local\Temp\zbnqmo.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fbylzbe.zt

Path C:\Users\Admin\AppData\Local\Temp\fbylzbe.zt
Size 5KB
SHA256 c6c90cbc07ad930de984e5b04d34e63ed4ffbfe66f9d9a9c7d73209b5cc25019
MD5 d6a5e2d3e2a0eeceda8a83e737e9dfd0
SHA1 01320182ad3ad9c4054442e3339946cdb0efc288
SHA512 bf418375c78e17f54149dab231aa1c0326b62b87784f5fb5ce5ec4206f9c90aa8c2ba2a9778e3247051a17c0e9516d06992fe6866cc873b6250359788d153a75
SSDEEP 96:4/IWZeEkYekh1+pVhQxOfsophsyZwcciG6sQnJ4hK0Qfyq+w6mA:4/ZNEuuhnZwccJ6sFKQHw6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

nfrrhr.w

Path C:\Users\Admin\AppData\Local\Temp\nfrrhr.w
Size 237KB
SHA256 e2b5bf434ccada8f2b3c2c1caa969d638f66a6a9568481e0a9e5efa24f73e266
MD5 8823228ec95e38f41ca26e6346ee8503
SHA1 51d952f995e36428c2df9cb8fa19d0ed7fed17d5
SHA512 f71409d9d6c4763456024280aa54eb6937942a6d0153499b49e912db42955d3f266b4235c837edecd826e65c6a9177d0b81f1d01a24d78be76798c5a322f4fd5
SSDEEP 6144:i52LGEJhQjedXErRzX6xJDLv0pnxvdslgQHC62Vp:o2LGQhQje6rRzUj2syQHCRVp
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbnqmo.exe

Path C:\Users\Admin\AppData\Local\Temp\zbnqmo.exe
Size 42KB
SHA256 4a3805e5a4525f7258107cab7323e320cc5b9e53c1cbf7b68463dbf7509c6292
MD5 ba63530f00b38e5596a0ed174e630815
SHA1 64f77b573411d94660e6f923fb32be989de4609f
SHA512 2e3f31a41500d9cfc86b1a847872ffff36c99d8c1b76a7b996fa0854a1e3d916716f696be64457de1e0bbbb5546656f1cb0e40c04cf679daeea9b44505247341
SSDEEP 768:vv4NY+HKdSf/2jX8i3SJPwktx8VStWHJduTJaspNaPqAg2NAUaUJSje:vvMYzkVmYwytWpctlpXBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbnqmo.exe

Path C:\Users\Admin\AppData\Local\Temp\zbnqmo.exe
Size 42KB
SHA256 4a3805e5a4525f7258107cab7323e320cc5b9e53c1cbf7b68463dbf7509c6292
MD5 ba63530f00b38e5596a0ed174e630815
SHA1 64f77b573411d94660e6f923fb32be989de4609f
SHA512 2e3f31a41500d9cfc86b1a847872ffff36c99d8c1b76a7b996fa0854a1e3d916716f696be64457de1e0bbbb5546656f1cb0e40c04cf679daeea9b44505247341
SSDEEP 768:vv4NY+HKdSf/2jX8i3SJPwktx8VStWHJduTJaspNaPqAg2NAUaUJSje:vvMYzkVmYwytWpctlpXBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbnqmo.exe

Path C:\Users\Admin\AppData\Local\Temp\zbnqmo.exe
Size 42KB
SHA256 4a3805e5a4525f7258107cab7323e320cc5b9e53c1cbf7b68463dbf7509c6292
MD5 ba63530f00b38e5596a0ed174e630815
SHA1 64f77b573411d94660e6f923fb32be989de4609f
SHA512 2e3f31a41500d9cfc86b1a847872ffff36c99d8c1b76a7b996fa0854a1e3d916716f696be64457de1e0bbbb5546656f1cb0e40c04cf679daeea9b44505247341
SSDEEP 768:vv4NY+HKdSf/2jX8i3SJPwktx8VStWHJduTJaspNaPqAg2NAUaUJSje:vvMYzkVmYwytWpctlpXBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbnqmo.exe

Path \Users\Admin\AppData\Local\Temp\zbnqmo.exe
Size 42KB
SHA256 4a3805e5a4525f7258107cab7323e320cc5b9e53c1cbf7b68463dbf7509c6292
MD5 ba63530f00b38e5596a0ed174e630815
SHA1 64f77b573411d94660e6f923fb32be989de4609f
SHA512 2e3f31a41500d9cfc86b1a847872ffff36c99d8c1b76a7b996fa0854a1e3d916716f696be64457de1e0bbbb5546656f1cb0e40c04cf679daeea9b44505247341
SSDEEP 768:vv4NY+HKdSf/2jX8i3SJPwktx8VStWHJduTJaspNaPqAg2NAUaUJSje:vvMYzkVmYwytWpctlpXBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbnqmo.exe

Path \Users\Admin\AppData\Local\Temp\zbnqmo.exe
Size 42KB
SHA256 4a3805e5a4525f7258107cab7323e320cc5b9e53c1cbf7b68463dbf7509c6292
MD5 ba63530f00b38e5596a0ed174e630815
SHA1 64f77b573411d94660e6f923fb32be989de4609f
SHA512 2e3f31a41500d9cfc86b1a847872ffff36c99d8c1b76a7b996fa0854a1e3d916716f696be64457de1e0bbbb5546656f1cb0e40c04cf679daeea9b44505247341
SSDEEP 768:vv4NY+HKdSf/2jX8i3SJPwktx8VStWHJduTJaspNaPqAg2NAUaUJSje:vvMYzkVmYwytWpctlpXBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbnqmo.exe

Path \Users\Admin\AppData\Local\Temp\zbnqmo.exe
Size 42KB
SHA256 4a3805e5a4525f7258107cab7323e320cc5b9e53c1cbf7b68463dbf7509c6292
MD5 ba63530f00b38e5596a0ed174e630815
SHA1 64f77b573411d94660e6f923fb32be989de4609f
SHA512 2e3f31a41500d9cfc86b1a847872ffff36c99d8c1b76a7b996fa0854a1e3d916716f696be64457de1e0bbbb5546656f1cb0e40c04cf679daeea9b44505247341
SSDEEP 768:vv4NY+HKdSf/2jX8i3SJPwktx8VStWHJduTJaspNaPqAg2NAUaUJSje:vvMYzkVmYwytWpctlpXBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1292-67-0x0000000001DD0000-0x0000000001DFE000-memory.dmp

Download

memory/1292-68-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1784-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Download