agenttesla | 564e748a2164cc70ec2c77d9830e301dedc3439f165fd8cc798bbd53fa168862

General

Target

6cca2ddbe7b661e17343d57dcd7fea8d74f33660.exe
Size

550KB
MD5

dbe24d23efd43e8172cde43ca708ab74
SHA1

6cca2ddbe7b661e17343d57dcd7fea8d74f33660
SHA256

564e748a2164cc70ec2c77d9830e301dedc3439f165fd8cc798bbd53fa168862
SHA512

39a2494b2998da50390c6fd9bedaf30a55841df3ad25f9b8ff4a6df1967ce5ab18a85bffd6a4869ee812ed1093abf6b743cdffa057d9d79a3565319b6e1b4daa
SSDEEP

12288:aYz8Z4wLYeghoJZA76hs0OI+NYNydH5t7X:aYg50b6DA72snhOk5

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
3408	ndmppks.exe
1448	ndmppks.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ndmppks.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ndmppks.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ndmppks.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 1448	3408	ndmppks.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1448	ndmppks.exe
1448	ndmppks.exe
1448	ndmppks.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3408	ndmppks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	ndmppks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1448	ndmppks.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3408	2564	6cca2ddbe7b661e17343d57dcd7fea8d74f33660.exe	79
PID 2564 wrote to memory of 3408	2564	6cca2ddbe7b661e17343d57dcd7fea8d74f33660.exe	79
PID 2564 wrote to memory of 3408	2564	6cca2ddbe7b661e17343d57dcd7fea8d74f33660.exe	79
PID 3408 wrote to memory of 1448	3408	ndmppks.exe	80
PID 3408 wrote to memory of 1448	3408	ndmppks.exe	80
PID 3408 wrote to memory of 1448	3408	ndmppks.exe	80
PID 3408 wrote to memory of 1448	3408	ndmppks.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ndmppks.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ndmppks.exe

C:\Users\Admin\AppData\Local\Temp\6cca2ddbe7b661e17343d57dcd7fea8d74f33660.exe
"C:\Users\Admin\AppData\Local\Temp\6cca2ddbe7b661e17343d57dcd7fea8d74f33660.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\ndmppks.exe
  "C:\Users\Admin\AppData\Local\Temp\ndmppks.exe" C:\Users\Admin\AppData\Local\Temp\iepcycqig.q
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Users\Admin\AppData\Local\Temp\ndmppks.exe
    "C:\Users\Admin\AppData\Local\Temp\ndmppks.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:1448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iepcycqig.q

Filesize
5KB

MD5
22d2f98c6e38acf657d8c6c2b81d2451

SHA1
7f491fd76b15eb51fbd77638f85726890b433cbe

SHA256
415f924c971fbe4856d1cbf8b2eea198d9d5b5dc2bbfb7634ff3c4c37e127611

SHA512
cdbdefebf26ea140a6c017b17180edeba17e6b64588a98ad9750c1dd149acae3701f43d97baf693c8e3ed28394ac37e69f5378ffad7bcf34924221ddfdd15ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndmppks.exe

Filesize
48KB

MD5
804fdca60b9f80f7836a57325956e474

SHA1
da100bbb7b1d85b91b0a01df42a0018e9bd56560

SHA256
2fa5fba4902ae2c0db0997ff261ae7038602004a63a9967e405ea422cb41fef9

SHA512
6a1377a787d132be590cede5eafeb939c97fa9e396ee5e00ee2784b733827ef7447152fc4ae01b0b91d91161a900ae225ca5d3fdd4bf403c575bc5b1e85be8c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndmppks.exe

Filesize
48KB

MD5
804fdca60b9f80f7836a57325956e474

SHA1
da100bbb7b1d85b91b0a01df42a0018e9bd56560

SHA256
2fa5fba4902ae2c0db0997ff261ae7038602004a63a9967e405ea422cb41fef9

SHA512
6a1377a787d132be590cede5eafeb939c97fa9e396ee5e00ee2784b733827ef7447152fc4ae01b0b91d91161a900ae225ca5d3fdd4bf403c575bc5b1e85be8c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndmppks.exe

Filesize
48KB

MD5
804fdca60b9f80f7836a57325956e474

SHA1
da100bbb7b1d85b91b0a01df42a0018e9bd56560

SHA256
2fa5fba4902ae2c0db0997ff261ae7038602004a63a9967e405ea422cb41fef9

SHA512
6a1377a787d132be590cede5eafeb939c97fa9e396ee5e00ee2784b733827ef7447152fc4ae01b0b91d91161a900ae225ca5d3fdd4bf403c575bc5b1e85be8c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\qgrjl.ism

Filesize
294KB

MD5
5e8e638d924354fa33e4b642ce7f8e75

SHA1
d7a299d528c887f49e7ca8ce46a8769fdc9308f2

SHA256
802e71a641afe964c8a7f4c613e438c99ba008e122a4403a2b4552b03c769e83

SHA512
aae411b9c9f0bdc420e1a1e41e28bc4d37cdee1144e1562af4424af5121cd94caea667ed44583ca036eddb91ced623d1eba65384c8b33545906b6280a6e2bd35

Download Submit
memory/1448-139-0x00000000049F0000-0x0000000004F94000-memory.dmp

Filesize
5.6MB

Download
memory/1448-140-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1448-141-0x0000000004FB0000-0x000000000504C000-memory.dmp

Filesize
624KB

Download
memory/1448-142-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/1448-143-0x00000000064F0000-0x0000000006582000-memory.dmp

Filesize
584KB

Download
memory/1448-144-0x00000000066F0000-0x0000000006740000-memory.dmp

Filesize
320KB

Download
memory/1448-145-0x0000000006790000-0x000000000679A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing