agenttesla | 7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db

General

Target

7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
Size

1.1MB
MD5

c8f78f4ec916de2a794ada0f74524a92
SHA1

c5e78e9d7fbac0572d8b276968799bbced619cc7
SHA256

7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db
SHA512

b2c2fe87e2a335477a179ef184a0f10c389965e9774a6b4608de24ca2a37cc42592a43d7f7e2a50bc9c5a16dfaacefe970f87454acfdac7b6b4a7d2a338fe009
SSDEEP

12288:YV4g0gWsfISQ5KDYmMjlyCwv8GJhzVJMAv5gSi8riwUTiLdw/6WHvYM16ffrifPc:y0gWBSM8j/JhxZiSi8lUTyvWX1Qf+c

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5590596148:AAFELAezvK26mOp3KWIpAgxEVzQMQ56n6zg/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JxkFp = "C:\\Users\\Admin\\AppData\\Roaming\\JxkFp\\JxkFp.exe"	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3244	powershell.exe
1836	powershell.exe
1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
1776	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
1776	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
3244	powershell.exe
1836	powershell.exe
1776	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
Token: SeDebugPrivilege	1776	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1776	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1836	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	89
PID 1944 wrote to memory of 1836	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	89
PID 1944 wrote to memory of 1836	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	89
PID 1944 wrote to memory of 3244	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	91
PID 1944 wrote to memory of 3244	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	91
PID 1944 wrote to memory of 3244	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	91
PID 1944 wrote to memory of 1756	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	93
PID 1944 wrote to memory of 1756	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	93
PID 1944 wrote to memory of 1756	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	93
PID 1944 wrote to memory of 928	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	95
PID 1944 wrote to memory of 928	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	95
PID 1944 wrote to memory of 928	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	95
PID 1944 wrote to memory of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96
PID 1944 wrote to memory of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96
PID 1944 wrote to memory of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96
PID 1944 wrote to memory of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96
PID 1944 wrote to memory of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96
PID 1944 wrote to memory of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96
PID 1944 wrote to memory of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96
PID 1944 wrote to memory of 1776	1944	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe	96

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe

C:\Users\Admin\AppData\Local\Temp\7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
"C:\Users\Admin\AppData\Local\Temp\7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YPAKilfGihHhm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YPAKilfGihHhm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp445C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
  "C:\Users\Admin\AppData\Local\Temp\7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe"
  2⤵
  PID:928
- C:\Users\Admin\AppData\Local\Temp\7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe
  "C:\Users\Admin\AppData\Local\Temp\7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
936B

MD5
a6b393f4670ae78d18784531f640a903

SHA1
80d36c8dea9f3e29ffdc4af28fd4caa2f95b9deb

SHA256
d57c23fef3f5d5f2dcfb1aa3e589e79d55614a94c2a82b9e875d3667caec22a0

SHA512
ecb35e25f3d17756855f425b8f4b06fe7cae5d70e0cd537e2cdc2d0fb5c6215f1628ebd8aacb3126928fdf9277372241ff188c753fdfd769a045dc3166bd97cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp445C.tmp

Filesize
1KB

MD5
09aa7f5eaaebf552c02fe4bd08363898

SHA1
353a2555bf4d7da843fffbb645795dc9d9194ade

SHA256
88ebea97aa79fdc59a285bdfa41464ddd472e41cf45cff322b92b5194e7b38c1

SHA512
869355e877c915f7888398096a3e53c74185459ae7ee4ee66fc01238ad8a7ba00a52aa8a939403fcc2439e0b31c0afd56b45693ad850d67ba7bcaf6cae33620a

Download Submit
memory/1776-148-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1776-158-0x0000000007030000-0x0000000007080000-memory.dmp

Filesize
320KB

Download
memory/1836-138-0x00000000053D0000-0x0000000005406000-memory.dmp

Filesize
216KB

Download
memory/1836-143-0x00000000059A0000-0x00000000059C2000-memory.dmp

Filesize
136KB

Download
memory/1836-153-0x0000000006F10000-0x0000000006F2E000-memory.dmp

Filesize
120KB

Download
memory/1836-145-0x0000000006330000-0x0000000006396000-memory.dmp

Filesize
408KB

Download
memory/1836-160-0x0000000007FA0000-0x0000000007FBA000-memory.dmp

Filesize
104KB

Download
memory/1836-152-0x0000000071800000-0x000000007184C000-memory.dmp

Filesize
304KB

Download
memory/1836-141-0x0000000005B30000-0x0000000006158000-memory.dmp

Filesize
6.2MB

Download
memory/1836-155-0x0000000007C60000-0x0000000007C7A000-memory.dmp

Filesize
104KB

Download
memory/1836-161-0x0000000007F80000-0x0000000007F88000-memory.dmp

Filesize
32KB

Download
memory/1944-132-0x0000000000470000-0x0000000000584000-memory.dmp

Filesize
1.1MB

Download
memory/1944-135-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/1944-134-0x0000000004FB0000-0x0000000005042000-memory.dmp

Filesize
584KB

Download
memory/1944-136-0x0000000007380000-0x000000000741C000-memory.dmp

Filesize
624KB

Download
memory/1944-133-0x00000000054C0000-0x0000000005A64000-memory.dmp

Filesize
5.6MB

Download
memory/3244-150-0x0000000006010000-0x0000000006042000-memory.dmp

Filesize
200KB

Download
memory/3244-156-0x0000000006DC0000-0x0000000006DCA000-memory.dmp

Filesize
40KB

Download
memory/3244-157-0x0000000006FD0000-0x0000000007066000-memory.dmp

Filesize
600KB

Download
memory/3244-154-0x00000000073A0000-0x0000000007A1A000-memory.dmp

Filesize
6.5MB

Download
memory/3244-159-0x0000000006F80000-0x0000000006F8E000-memory.dmp

Filesize
56KB

Download
memory/3244-151-0x0000000071800000-0x000000007184C000-memory.dmp

Filesize
304KB

Download
memory/3244-149-0x0000000005A50000-0x0000000005A6E000-memory.dmp

Filesize
120KB

Download
memory/3244-144-0x00000000052C0000-0x0000000005326000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads