agenttesla | 520fa2c1a9c0ce8db4cc44c94cb6f3634bf644c80627d29fb57cdaada2025303

Analysis

max time kernel
107s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2023, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 437KB
Sample230119-rwvxjsdb7s
SHA256 520fa2c1a9c0ce8db4cc44c94cb6f3634bf644c80627d29fb57cdaada2025303
MD5 df15fd20a3afcb137fe6c1529a1559af
SHA1 72b6769ee78feb0fdadf305a46a0682cbd08d061
SHA512 b1a783203d900a1f55bd1109b42003c96b115361ad4b0e9f7f074d1835f42634b3da228c20867a88661a2c33df7501ec203be928f8c587b093fb3fdacc318133
SSDEEP 6144:qYa68NzWlcEHScLCwfywN7IqsMO3OHjUtloFQc7XGDpArgDTiN:qYYhElflBIj3OHKloFBGDpAriiN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
3132	jrmizrhv.exe
1672	jrmizrhv.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jrmizrhv.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jrmizrhv.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jrmizrhv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RMBJLaF = "C:\\Users\\Admin\\AppData\\Roaming\\RMBJLaF\\RMBJLaF.exe"	jrmizrhv.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
17	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3132 set thread context of 1672	3132	jrmizrhv.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1672	jrmizrhv.exe
1672	jrmizrhv.exe
1672	jrmizrhv.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3132	jrmizrhv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	jrmizrhv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 3132	1232	file.exe	82
PID 1232 wrote to memory of 3132	1232	file.exe	82
PID 1232 wrote to memory of 3132	1232	file.exe	82
PID 3132 wrote to memory of 1672	3132	jrmizrhv.exe	83
PID 3132 wrote to memory of 1672	3132	jrmizrhv.exe	83
PID 3132 wrote to memory of 1672	3132	jrmizrhv.exe	83
PID 3132 wrote to memory of 1672	3132	jrmizrhv.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jrmizrhv.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jrmizrhv.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\jrmizrhv.exe
  "C:\Users\Admin\AppData\Local\Temp\jrmizrhv.exe" C:\Users\Admin\AppData\Local\Temp\ocjznno.rq
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Users\Admin\AppData\Local\Temp\jrmizrhv.exe
    "C:\Users\Admin\AppData\Local\Temp\jrmizrhv.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jrmizrhv.exe

Path C:\Users\Admin\AppData\Local\Temp\jrmizrhv.exe
Size 50KB
SHA256 94c8e7275f5a8ac45b9d06db99c233bcd32c8d7bfafabef68650fe4a4e9d766c
MD5 313c047fad6490e9440eef443dea3e8b
SHA1 a6cdb23f17b203b7d4c84156daf7ba1a77cb5ec2
SHA512 7bf76921d825fe0176f7b7bfc3879ea5570515cf2fc9b0eb35d3920e54535b3791ee4bcd0309e5f02a89efb6369f513731d417c8e55747c52d9f5f3625d9e70b
SSDEEP 768:hghRVbO+GDnPsEs6/9Ky3KmbY9FEhKNbGVNKQ5cz/qiXaNKBWJyCysQT+l:2xGDnPQsUbuNHe7qiLVLh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

jrmizrhv.exe

Path C:\Users\Admin\AppData\Local\Temp\jrmizrhv.exe
Size 50KB
SHA256 94c8e7275f5a8ac45b9d06db99c233bcd32c8d7bfafabef68650fe4a4e9d766c
MD5 313c047fad6490e9440eef443dea3e8b
SHA1 a6cdb23f17b203b7d4c84156daf7ba1a77cb5ec2
SHA512 7bf76921d825fe0176f7b7bfc3879ea5570515cf2fc9b0eb35d3920e54535b3791ee4bcd0309e5f02a89efb6369f513731d417c8e55747c52d9f5f3625d9e70b
SSDEEP 768:hghRVbO+GDnPsEs6/9Ky3KmbY9FEhKNbGVNKQ5cz/qiXaNKBWJyCysQT+l:2xGDnPQsUbuNHe7qiLVLh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

jrmizrhv.exe

Path C:\Users\Admin\AppData\Local\Temp\jrmizrhv.exe
Size 50KB
SHA256 94c8e7275f5a8ac45b9d06db99c233bcd32c8d7bfafabef68650fe4a4e9d766c
MD5 313c047fad6490e9440eef443dea3e8b
SHA1 a6cdb23f17b203b7d4c84156daf7ba1a77cb5ec2
SHA512 7bf76921d825fe0176f7b7bfc3879ea5570515cf2fc9b0eb35d3920e54535b3791ee4bcd0309e5f02a89efb6369f513731d417c8e55747c52d9f5f3625d9e70b
SSDEEP 768:hghRVbO+GDnPsEs6/9Ky3KmbY9FEhKNbGVNKQ5cz/qiXaNKBWJyCysQT+l:2xGDnPQsUbuNHe7qiLVLh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ocjznno.rq

Path C:\Users\Admin\AppData\Local\Temp\ocjznno.rq
Size 5KB
SHA256 0dd6ca49dcc895fafe428d83d2b7c4fbcab24cdbb80cb013d54d11d0bd56686f
MD5 ce536e9bbe4b9dce9c1c000edc32e66c
SHA1 d24e95c35ed2edad7fab71e4c963ffa438909f51
SHA512 4049c9b84a6930b624eb6597952d4819e4bd3ca03f1592076bacaf35f7273fb4c0622becb8cec4aa6d737069767a897d0ec18a909c74de42e8c6a4da01b4be1a
SSDEEP 96:Farc6oYEg/DrYu4gk2XO5oSwg1vfJ6EFdRd/+WTuegU15FIC9OiPvbXCmbvrfjXC:FarcRUhhX1Sl1HwEn7/+WyegU15rJLru
MD5 SHA1 SHA512 SSDEEP

Submit Download

unxrm.g

Path C:\Users\Admin\AppData\Local\Temp\unxrm.g
Size 258KB
SHA256 98f6050dbeb0de656369167c521801463c266cebab03b8dbfdbc3e967382b515
MD5 6d7d825380128ba839bd6efb24b718de
SHA1 5a9eb8d61926adb67ae52688aaa50343e2b269dc
SHA512 9aa7780012a98952d604e6d93fede8d91b67aaa51e724d3f55fae34c22a404c3ed8ba71fdaafaf46c84382017af48aa968acca6f176cb6ca17f42efaf54027a1
SSDEEP 3072:rorbErfsFpfj1kcOz+H6uslmtZQ94nCwWGXt8XTUClxVCNnlBcHpgu0+XrAu3qHs:yJfPOiUmtZs4nCk8j9x4cio36qvvRFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1672-139-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1672-140-0x00000000049A0000-0x0000000004F44000-memory.dmp

Download

memory/1672-141-0x0000000004F80000-0x000000000501C000-memory.dmp

Download

memory/1672-142-0x0000000005930000-0x0000000005996000-memory.dmp

Download

memory/1672-143-0x0000000006310000-0x00000000063A2000-memory.dmp

Download

memory/1672-144-0x00000000063C0000-0x00000000063CA000-memory.dmp

Download

memory/1672-145-0x0000000006900000-0x0000000006950000-memory.dmp

Download