agenttesla | 1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532

General

Target

1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe
Size

1.0MB
MD5

87bcb7dc95d3d9ddf01fb453b3e96824
SHA1

31a6f0e2ac4e4e44795991b9ae5de3ac21f3c66a
SHA256

1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532
SHA512

59d57789312d6e1d4db962956b0b69ce576bcb07bacf275a3694f9fe624aedab373a57236e3791d07f95661582b28ca5b797f861e973b60e9d0354ea127fe11f
SSDEEP

12288:nt2iN1/Sr+peUv5KDl+mX/bMh2O5jCaCMJaBc4rCeijhJ0KSl+jO3H8c+9eFf+mu:nt1e+lgRTMhh3CMJaNmei9UsjO3H80

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5940813834:AAF8mKehOQ2jtgluy4NISP8DYRvxgz__xCQ/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1000	MSBuild.exe
1000	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28
PID 1504 wrote to memory of 1000	1504	1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe
"C:\Users\Admin\AppData\Local\Temp\1a53c645d8a4df7f6cd796b426512ff27cbb40988b73248e6feb8a8a498b9532.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1000-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1000-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1000-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1000-66-0x000000000043773E-mapping.dmp

Download
memory/1000-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1000-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1000-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1504-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1504-54-0x00000000008E0000-0x00000000009EE000-memory.dmp

Filesize
1.1MB

Download
memory/1504-59-0x00000000021C0000-0x00000000021FC000-memory.dmp

Filesize
240KB

Download
memory/1504-58-0x0000000005290000-0x0000000005306000-memory.dmp

Filesize
472KB

Download
memory/1504-57-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download
memory/1504-56-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing