agenttesla | 87e32aa4c7cdad4872573c0d62e51e9256d1c774dbdebd2cb2e706734aa69e1f

General

Target

PURCHASE ORDER.exe
Size

434KB
MD5

f25a05273ba3897ae6d5211dd42bf896
SHA1

6def904f769fe8ef1e3da3e4305fd36fc162176a
SHA256

87e32aa4c7cdad4872573c0d62e51e9256d1c774dbdebd2cb2e706734aa69e1f
SHA512

52050da9da3a70d4c39a05ebfb720998b0b98c077b6996985cce7924711389df7196da8d85e53723b24f17c311dab0551b087161283d46ba1756f6cd2d06f0a2
SSDEEP

6144:uYa63eDljYsa/ahTp42vAHkp2xv/hQ8MUlEeYBbE:uYMlMsgET1vRp2VpQ8MuvYBbE

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sseximclearing.com
Port:
587
Username:
[email protected]
Password:
Ssxm@9854
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
520	ochfhrpklc.exe
592	ochfhrpklc.exe

Loads dropped DLL 3 IoCs

pid	Process
1728	PURCHASE ORDER.exe
1728	PURCHASE ORDER.exe
520	ochfhrpklc.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ochfhrpklc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ochfhrpklc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ochfhrpklc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 520 set thread context of 592	520	ochfhrpklc.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
592	ochfhrpklc.exe
592	ochfhrpklc.exe
592	ochfhrpklc.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
520	ochfhrpklc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	ochfhrpklc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 520	1728	PURCHASE ORDER.exe	28
PID 1728 wrote to memory of 520	1728	PURCHASE ORDER.exe	28
PID 1728 wrote to memory of 520	1728	PURCHASE ORDER.exe	28
PID 1728 wrote to memory of 520	1728	PURCHASE ORDER.exe	28
PID 520 wrote to memory of 592	520	ochfhrpklc.exe	29
PID 520 wrote to memory of 592	520	ochfhrpklc.exe	29
PID 520 wrote to memory of 592	520	ochfhrpklc.exe	29
PID 520 wrote to memory of 592	520	ochfhrpklc.exe	29
PID 520 wrote to memory of 592	520	ochfhrpklc.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ochfhrpklc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ochfhrpklc.exe

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe
  "C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe" C:\Users\Admin\AppData\Local\Temp\ntiydcsvzue.u
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe
    "C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kkajibsa.ac

Filesize
257KB

MD5
9ce837ddd9c3ba9a65e8aa2061defbd9

SHA1
4af697e1d0d7c2dfd8fd552580b8948d768ff423

SHA256
933f60a21c64c1a5f767e08687c8a3a1911cef0563bb5b343976eb825120fc5f

SHA512
dd0cb28238ecfbb67d6247d598b9607905b63fc08698ac4ef8f985d2368c4676d6570d9c09dc74aa6c365bf839fce3947f091391251f945802e30e73f882b1b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntiydcsvzue.u

Filesize
5KB

MD5
3914eef11e7aca508d6e14e269d597f4

SHA1
2b827136201c218943454bee4ae44d41dc8e8ec8

SHA256
60813c76ce5cb6ce27ffbb799e6c6512aace4bfca2f4e3038f04af7787ac9d30

SHA512
6e59778780dc6718114033942251d4686933018e1a36dc32bd615d0c83d15be2b5a4b2110da660020d7d944ad020245ea0ea9d8163f06b8db3d06fb1d01f0c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe

Filesize
48KB

MD5
9abb06e414e784d09eb96997b2d1a336

SHA1
d7956125a07ccc073b61f71eefc0e5e89c465487

SHA256
3b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5

SHA512
24e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281

Download Submit
C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe

Filesize
48KB

MD5
9abb06e414e784d09eb96997b2d1a336

SHA1
d7956125a07ccc073b61f71eefc0e5e89c465487

SHA256
3b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5

SHA512
24e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281

Download Submit
C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe

Filesize
48KB

MD5
9abb06e414e784d09eb96997b2d1a336

SHA1
d7956125a07ccc073b61f71eefc0e5e89c465487

SHA256
3b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5

SHA512
24e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281

Download Submit
\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe

Filesize
48KB

MD5
9abb06e414e784d09eb96997b2d1a336

SHA1
d7956125a07ccc073b61f71eefc0e5e89c465487

SHA256
3b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5

SHA512
24e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281

Download Submit
\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe

Filesize
48KB

MD5
9abb06e414e784d09eb96997b2d1a336

SHA1
d7956125a07ccc073b61f71eefc0e5e89c465487

SHA256
3b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5

SHA512
24e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281

Download Submit
\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe

Filesize
48KB

MD5
9abb06e414e784d09eb96997b2d1a336

SHA1
d7956125a07ccc073b61f71eefc0e5e89c465487

SHA256
3b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5

SHA512
24e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281

Download Submit
memory/592-67-0x00000000004E0000-0x000000000050E000-memory.dmp

Filesize
184KB

Download
memory/592-68-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1728-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing