agenttesla | 5ace7702d0fa480105ae05c8edd6344513b3f911d4257a6dec9c123d66a8e594

General

Target

5ace7702d0fa480105ae05c8edd6344513b3f911d4257a6dec9c123d66a8e594.exe
Size

525KB
MD5

e2733a5dd19a546275fca8f958569312
SHA1

517fa0d68f0604508b3c65d36ab15114ccf9acc1
SHA256

5ace7702d0fa480105ae05c8edd6344513b3f911d4257a6dec9c123d66a8e594
SHA512

80ff304269a4df1118c889871240c1a4c9f2e5d7966644690ef1056d00662f040ea4352bcde3cdece65cf4e4a55e229c321567c705c96fd5ddaf2cfb70ceaafb
SSDEEP

12288:HY3shrtvJ4uNMIL/TzLN4kBII2CIXwW97SK4+CW/oVdoM:HYa1KAH3II2HXV7Sgk

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.valvulasthermovalve.cl
Port:
21
Username:
[email protected]
Password:
LILKOOLL14!!

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 4 IoCs

pid	Process
2264	zlsuy.exe
4352	zlsuy.exe
4136	zlsuy.exe
4756	zlsuy.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zlsuy.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zlsuy.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zlsuy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2264 set thread context of 4756	2264	zlsuy.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4756	zlsuy.exe
4756	zlsuy.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2264	zlsuy.exe
2264	zlsuy.exe
2264	zlsuy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	zlsuy.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2264	3228	5ace7702d0fa480105ae05c8edd6344513b3f911d4257a6dec9c123d66a8e594.exe	81
PID 3228 wrote to memory of 2264	3228	5ace7702d0fa480105ae05c8edd6344513b3f911d4257a6dec9c123d66a8e594.exe	81
PID 3228 wrote to memory of 2264	3228	5ace7702d0fa480105ae05c8edd6344513b3f911d4257a6dec9c123d66a8e594.exe	81
PID 2264 wrote to memory of 4352	2264	zlsuy.exe	83
PID 2264 wrote to memory of 4352	2264	zlsuy.exe	83
PID 2264 wrote to memory of 4352	2264	zlsuy.exe	83
PID 2264 wrote to memory of 4136	2264	zlsuy.exe	84
PID 2264 wrote to memory of 4136	2264	zlsuy.exe	84
PID 2264 wrote to memory of 4136	2264	zlsuy.exe	84
PID 2264 wrote to memory of 4756	2264	zlsuy.exe	85
PID 2264 wrote to memory of 4756	2264	zlsuy.exe	85
PID 2264 wrote to memory of 4756	2264	zlsuy.exe	85
PID 2264 wrote to memory of 4756	2264	zlsuy.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zlsuy.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zlsuy.exe

C:\Users\Admin\AppData\Local\Temp\5ace7702d0fa480105ae05c8edd6344513b3f911d4257a6dec9c123d66a8e594.exe
"C:\Users\Admin\AppData\Local\Temp\5ace7702d0fa480105ae05c8edd6344513b3f911d4257a6dec9c123d66a8e594.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\zlsuy.exe
  "C:\Users\Admin\AppData\Local\Temp\zlsuy.exe" C:\Users\Admin\AppData\Local\Temp\rtliuo.x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Users\Admin\AppData\Local\Temp\zlsuy.exe
    "C:\Users\Admin\AppData\Local\Temp\zlsuy.exe"
    3⤵
    - Executes dropped EXE
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\zlsuy.exe
    "C:\Users\Admin\AppData\Local\Temp\zlsuy.exe"
    3⤵
    - Executes dropped EXE
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\zlsuy.exe
    "C:\Users\Admin\AppData\Local\Temp\zlsuy.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rtliuo.x

Filesize
5KB

MD5
8d624e5504a97250b8c1fa3d83db0e05

SHA1
fcd8b4ed0aadb8bba9a9962995c668df218c27ed

SHA256
9e7bfd63c3bb515d1e3abd9ec89a70138f44fa94c53b2bc203586ed9d97187f6

SHA512
3e0679d03681f7caa77ebdbfa078a9713187be38d182abc12fa2d4e4de59821151ffe5b9d8961ee7445e50ad92a773105398ae9df29941d6dc1be66082363d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xbritzpb.jl

Filesize
307KB

MD5
4a9d44158a7bfcd0fd1ec875ded60617

SHA1
b26e473baa2f5ca098dff6389482a90cb6856a8c

SHA256
1367c8b1b7bad04734a69fb76c8a42c39dbbdc102ac099a9584a8c56269c2b7f

SHA512
d281ea8025578040247ff783c9636dbc1f4c133b2fdbfbcc5edae9015189487637e596bf681761e870f6bb9e7efff778e1bb490d3c382406975e85aeeb15fdb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlsuy.exe

Filesize
62KB

MD5
137d415fd4c0b0de1627cf9abf985ae5

SHA1
bf0c76fa80b800d94db48a1180d146cc2d26647f

SHA256
ae26439b268a3368f97b0086a66b87f171ab1195ab16bc5d7067366de3916c59

SHA512
e82a09b747d96a4fa88fad423093838408da82e4e51b3daa09a07cc8a387df16fcc87a34c7d860f66914c8134351c055e9f844ea4f52d01b11b88bed04eb8d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlsuy.exe

Filesize
62KB

MD5
137d415fd4c0b0de1627cf9abf985ae5

SHA1
bf0c76fa80b800d94db48a1180d146cc2d26647f

SHA256
ae26439b268a3368f97b0086a66b87f171ab1195ab16bc5d7067366de3916c59

SHA512
e82a09b747d96a4fa88fad423093838408da82e4e51b3daa09a07cc8a387df16fcc87a34c7d860f66914c8134351c055e9f844ea4f52d01b11b88bed04eb8d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlsuy.exe

Filesize
62KB

MD5
137d415fd4c0b0de1627cf9abf985ae5

SHA1
bf0c76fa80b800d94db48a1180d146cc2d26647f

SHA256
ae26439b268a3368f97b0086a66b87f171ab1195ab16bc5d7067366de3916c59

SHA512
e82a09b747d96a4fa88fad423093838408da82e4e51b3daa09a07cc8a387df16fcc87a34c7d860f66914c8134351c055e9f844ea4f52d01b11b88bed04eb8d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlsuy.exe

Filesize
62KB

MD5
137d415fd4c0b0de1627cf9abf985ae5

SHA1
bf0c76fa80b800d94db48a1180d146cc2d26647f

SHA256
ae26439b268a3368f97b0086a66b87f171ab1195ab16bc5d7067366de3916c59

SHA512
e82a09b747d96a4fa88fad423093838408da82e4e51b3daa09a07cc8a387df16fcc87a34c7d860f66914c8134351c055e9f844ea4f52d01b11b88bed04eb8d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlsuy.exe

Filesize
62KB

MD5
137d415fd4c0b0de1627cf9abf985ae5

SHA1
bf0c76fa80b800d94db48a1180d146cc2d26647f

SHA256
ae26439b268a3368f97b0086a66b87f171ab1195ab16bc5d7067366de3916c59

SHA512
e82a09b747d96a4fa88fad423093838408da82e4e51b3daa09a07cc8a387df16fcc87a34c7d860f66914c8134351c055e9f844ea4f52d01b11b88bed04eb8d4f

Download Submit
memory/2264-132-0x0000000000000000-mapping.dmp

Download
memory/4136-139-0x0000000000000000-mapping.dmp

Download
memory/4352-137-0x0000000000000000-mapping.dmp

Download
memory/4756-140-0x0000000000000000-mapping.dmp

Download
memory/4756-143-0x0000000005C90000-0x0000000006234000-memory.dmp

Filesize
5.6MB

Download
memory/4756-144-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4756-145-0x00000000056E0000-0x000000000577C000-memory.dmp

Filesize
624KB

Download
memory/4756-146-0x0000000006640000-0x00000000066A6000-memory.dmp

Filesize
408KB

Download
memory/4756-147-0x0000000006A90000-0x0000000006AE0000-memory.dmp

Filesize
320KB

Download
memory/4756-148-0x0000000007140000-0x00000000071D2000-memory.dmp

Filesize
584KB

Download
memory/4756-149-0x00000000070E0000-0x00000000070EA000-memory.dmp

Filesize
40KB

Download

Resubmissions

Analysis

Sharing