agenttesla | 874f3c445ed43153d3b4961a98ccba831952fa444403f3abda19e393b9b35ebb

General

Target

0faf2b13bf2287d0c8191f879abc20374497d891.exe
Size

703KB
MD5

f34a371fbc755d99e600c88580b1a125
SHA1

0faf2b13bf2287d0c8191f879abc20374497d891
SHA256

874f3c445ed43153d3b4961a98ccba831952fa444403f3abda19e393b9b35ebb
SHA512

053679d5a51202003b3ce1bc9a4c222462741bdb65f2d5703960b61da9e429cdbc58b25933ad7b000b3cf0022a93e348d813eae20c9ae05e55547c318f54bc4f
SSDEEP

12288:4YVbEb1Sh4PQs27x4ry81mUM5zlbv2kuRaAscBJGG1wa:4YVbuA+PQjxkxy5hbvzuRaARBf13

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sseximclearing.com
Port:
587
Username:
[email protected]
Password:
Ssxm@9854
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
1668	whatsiff.exe
1304	whatsiff.exe

Loads dropped DLL 3 IoCs

pid	Process
1392	0faf2b13bf2287d0c8191f879abc20374497d891.exe
1392	0faf2b13bf2287d0c8191f879abc20374497d891.exe
1668	whatsiff.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	whatsiff.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	whatsiff.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	whatsiff.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1304	1668	whatsiff.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1304	whatsiff.exe
1304	whatsiff.exe
1304	whatsiff.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1668	whatsiff.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	whatsiff.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1668	1392	0faf2b13bf2287d0c8191f879abc20374497d891.exe	27
PID 1392 wrote to memory of 1668	1392	0faf2b13bf2287d0c8191f879abc20374497d891.exe	27
PID 1392 wrote to memory of 1668	1392	0faf2b13bf2287d0c8191f879abc20374497d891.exe	27
PID 1392 wrote to memory of 1668	1392	0faf2b13bf2287d0c8191f879abc20374497d891.exe	27
PID 1668 wrote to memory of 1304	1668	whatsiff.exe	28
PID 1668 wrote to memory of 1304	1668	whatsiff.exe	28
PID 1668 wrote to memory of 1304	1668	whatsiff.exe	28
PID 1668 wrote to memory of 1304	1668	whatsiff.exe	28
PID 1668 wrote to memory of 1304	1668	whatsiff.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	whatsiff.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	whatsiff.exe

C:\Users\Admin\AppData\Local\Temp\0faf2b13bf2287d0c8191f879abc20374497d891.exe
"C:\Users\Admin\AppData\Local\Temp\0faf2b13bf2287d0c8191f879abc20374497d891.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\whatsiff.exe
  "C:\Users\Admin\AppData\Local\Temp\whatsiff.exe" C:\Users\Admin\AppData\Local\Temp\lkavjgly.j
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\whatsiff.exe
    "C:\Users\Admin\AppData\Local\Temp\whatsiff.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lkavjgly.j

Filesize
5KB

MD5
6f9bde37ab94b43a540f1b7c9d2a2b10

SHA1
b82c973fff484497669f51fd0972ecfa3b1df2b4

SHA256
196d6c021e0cbf8e70ba6d6373afc8ffd63570ebc604920bf5b80f5e78f97277

SHA512
d4adb391b84bd3cdc0be645cbc1faa3a0ccf30c09e5bea1bae37021b1264c5d642f1794f61fa0ae8123ff8cd4945ce642b9db54910a8ec15f5f67ef5d4f65288

Download Submit
C:\Users\Admin\AppData\Local\Temp\whatsiff.exe

Filesize
61KB

MD5
f151f49e53125b7508c1161a9ef06d74

SHA1
ed148f98388d939caf89c745d5d7785b836548c7

SHA256
b97309111c255764012ac1d42db2f031f8289ae632fb8687a3c50798bb3a9ec6

SHA512
1179743879c43babdea5742420ef7d1bc68fee555456408d2ffb029801e306aaee07571bd53a41a6d1a664ca388c75a56e592cc701fe8d98ece9caeb620ced1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\whatsiff.exe

Filesize
61KB

MD5
f151f49e53125b7508c1161a9ef06d74

SHA1
ed148f98388d939caf89c745d5d7785b836548c7

SHA256
b97309111c255764012ac1d42db2f031f8289ae632fb8687a3c50798bb3a9ec6

SHA512
1179743879c43babdea5742420ef7d1bc68fee555456408d2ffb029801e306aaee07571bd53a41a6d1a664ca388c75a56e592cc701fe8d98ece9caeb620ced1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\whatsiff.exe

Filesize
61KB

MD5
f151f49e53125b7508c1161a9ef06d74

SHA1
ed148f98388d939caf89c745d5d7785b836548c7

SHA256
b97309111c255764012ac1d42db2f031f8289ae632fb8687a3c50798bb3a9ec6

SHA512
1179743879c43babdea5742420ef7d1bc68fee555456408d2ffb029801e306aaee07571bd53a41a6d1a664ca388c75a56e592cc701fe8d98ece9caeb620ced1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xbmzqshlh.wd

Filesize
257KB

MD5
32c50a963a37e3d3d8247c916bd5838e

SHA1
4a02af8746961706ab2b82c9d2e44e5988d51d8e

SHA256
ff183e66a9095121cea2acc408d1963b1d3541fb576da80a6dbe61029b8c70e7

SHA512
17a8c977fb3b73c311e7491ec9b2e027723c3fee2e00335519b6ac1c71d9947defe48c3414c9052c2a6d27099fcecd3d7ef812f4ad9ae5d49c5aec74487ad2df

Download Submit
\Users\Admin\AppData\Local\Temp\whatsiff.exe

Filesize
61KB

MD5
f151f49e53125b7508c1161a9ef06d74

SHA1
ed148f98388d939caf89c745d5d7785b836548c7

SHA256
b97309111c255764012ac1d42db2f031f8289ae632fb8687a3c50798bb3a9ec6

SHA512
1179743879c43babdea5742420ef7d1bc68fee555456408d2ffb029801e306aaee07571bd53a41a6d1a664ca388c75a56e592cc701fe8d98ece9caeb620ced1d

Download Submit
\Users\Admin\AppData\Local\Temp\whatsiff.exe

Filesize
61KB

MD5
f151f49e53125b7508c1161a9ef06d74

SHA1
ed148f98388d939caf89c745d5d7785b836548c7

SHA256
b97309111c255764012ac1d42db2f031f8289ae632fb8687a3c50798bb3a9ec6

SHA512
1179743879c43babdea5742420ef7d1bc68fee555456408d2ffb029801e306aaee07571bd53a41a6d1a664ca388c75a56e592cc701fe8d98ece9caeb620ced1d

Download Submit
\Users\Admin\AppData\Local\Temp\whatsiff.exe

Filesize
61KB

MD5
f151f49e53125b7508c1161a9ef06d74

SHA1
ed148f98388d939caf89c745d5d7785b836548c7

SHA256
b97309111c255764012ac1d42db2f031f8289ae632fb8687a3c50798bb3a9ec6

SHA512
1179743879c43babdea5742420ef7d1bc68fee555456408d2ffb029801e306aaee07571bd53a41a6d1a664ca388c75a56e592cc701fe8d98ece9caeb620ced1d

Download Submit
memory/1304-66-0x00000000004B0000-0x00000000004DE000-memory.dmp

Filesize
184KB

Download
memory/1304-67-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1392-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing