agenttesla | 9b56ffabf61e4df4b774d198a6397b9ac6f431a59245b8400afa0b60bb017866

Analysis

max time kernel
92s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2023, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INVOICE10321.exe
Size 299KB
Sample230124-rplqascb33
SHA256 9b56ffabf61e4df4b774d198a6397b9ac6f431a59245b8400afa0b60bb017866
MD5 8a2626023e28c07c0cee2722e31e86b8
SHA1 0fbc837912fe8cef3ed15610d48d4a939d7bd19b
SHA512 774f54bd54c5e6287311bf34d6404d69db51ac841feb488e0866728d8c9ba1f81bcae67c3e0b45004f1934a86e4793a680538742467098ed90ad59545cc28827
SSDEEP 6144:/Ya6smrFwlbM6p10Y0zYbvlvcqd4cYglfoK20zHGf:/YK2ubp1AcBvcqOg5R2yGf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/3280-141-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	gzhzytu.exe

Executes dropped EXE 2 IoCs

pid	Process
4776	gzhzytu.exe
3280	gzhzytu.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gzhzytu.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gzhzytu.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gzhzytu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\enyeqlaqm = "C:\\Users\\Admin\\AppData\\Roaming\\omgtoiuj\\pnjwyfc.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\gzhzytu.exe\" C:\\Users\\Admin\\AppData\\Local\\T"	gzhzytu.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 3280	4776	gzhzytu.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3280	gzhzytu.exe
3280	gzhzytu.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4776	gzhzytu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3280	gzhzytu.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4776	4336	INVOICE10321.exe	81
PID 4336 wrote to memory of 4776	4336	INVOICE10321.exe	81
PID 4336 wrote to memory of 4776	4336	INVOICE10321.exe	81
PID 4776 wrote to memory of 3280	4776	gzhzytu.exe	82
PID 4776 wrote to memory of 3280	4776	gzhzytu.exe	82
PID 4776 wrote to memory of 3280	4776	gzhzytu.exe	82
PID 4776 wrote to memory of 3280	4776	gzhzytu.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gzhzytu.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gzhzytu.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE10321.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE10321.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\gzhzytu.exe
  "C:\Users\Admin\AppData\Local\Temp\gzhzytu.exe" C:\Users\Admin\AppData\Local\Temp\vyyxhytsqz.wr
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\gzhzytu.exe
    "C:\Users\Admin\AppData\Local\Temp\gzhzytu.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gzhzytu.exe

Path C:\Users\Admin\AppData\Local\Temp\gzhzytu.exe
Size 5KB
SHA256 85d3d3fa90de54e60a599a4ec3ff42d0ad01f1f79a7bbeea08adf736de0ffbf2
MD5 15772ec21b0bc3c7abc1b504d45b3308
SHA1 881b500287d868d8d34e0d3f3e22ea593132cc21
SHA512 a6dd644244567246a979264eb1f811f2c1d7a3af29c5e9b98966dcf8930b136dcdb98d58998685916c192b2a619f0137afc7277ec28260f1f64d267f944221c4
SSDEEP 96:BvWjCrhD7IoZ6O1O8I3Pmoynw364DwflHh+x:lyC9v6VtPmoynwK4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

gzhzytu.exe

Path C:\Users\Admin\AppData\Local\Temp\gzhzytu.exe
Size 5KB
SHA256 85d3d3fa90de54e60a599a4ec3ff42d0ad01f1f79a7bbeea08adf736de0ffbf2
MD5 15772ec21b0bc3c7abc1b504d45b3308
SHA1 881b500287d868d8d34e0d3f3e22ea593132cc21
SHA512 a6dd644244567246a979264eb1f811f2c1d7a3af29c5e9b98966dcf8930b136dcdb98d58998685916c192b2a619f0137afc7277ec28260f1f64d267f944221c4
SSDEEP 96:BvWjCrhD7IoZ6O1O8I3Pmoynw364DwflHh+x:lyC9v6VtPmoynwK4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

gzhzytu.exe

Path C:\Users\Admin\AppData\Local\Temp\gzhzytu.exe
Size 5KB
SHA256 85d3d3fa90de54e60a599a4ec3ff42d0ad01f1f79a7bbeea08adf736de0ffbf2
MD5 15772ec21b0bc3c7abc1b504d45b3308
SHA1 881b500287d868d8d34e0d3f3e22ea593132cc21
SHA512 a6dd644244567246a979264eb1f811f2c1d7a3af29c5e9b98966dcf8930b136dcdb98d58998685916c192b2a619f0137afc7277ec28260f1f64d267f944221c4
SSDEEP 96:BvWjCrhD7IoZ6O1O8I3Pmoynw364DwflHh+x:lyC9v6VtPmoynwK4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

vyyxhytsqz.wr

Path C:\Users\Admin\AppData\Local\Temp\vyyxhytsqz.wr
Size 7KB
SHA256 760e322100adcb5ce6afc10ed10abd381aa421eeade8eb9e53f6f6f27ac67198
MD5 43a34489711ce5c005c140e07cf10e16
SHA1 10635541195be3866e4f5f4a5662275c548a4bf3
SHA512 c3607a20779691b50e21adcedac6f77489f526ea9a1d1789a639ea736f56f09aa6d3fb9d6f87c77a46c0e04d8fb312f7af40f160aa7978f03365d92f9d1d2d58
SSDEEP 192:darcitQvArWiPv6hb9jrJ6zH8sUIfuybvUX7fyv:uCYrNPv6FWH8Gm6sLyv
MD5 SHA1 SHA512 SSDEEP

Submit Download

xsgplvm.iyt

Path C:\Users\Admin\AppData\Local\Temp\xsgplvm.iyt
Size 314KB
SHA256 ede2cf4900b815347b718625e455c0bd9d0b84bd6873f240b3a5f0dc01ee5e49
MD5 fa1ceec7cc1d4160fc94e7de5d55827d
SHA1 8b229bc4343dc25a36d8004c654f5001b241e3c1
SHA512 80f6f0fd35f09b0bd9af0646dc1de36aa5da41242afa9da78757c78123b064a35c7f70fab21cbd65e01f582e1015ca64437cfd38204373334396a0f4283da2b3
SSDEEP 6144:wgysXyX9+QuJFIckvwUhBKV5TrWveesMLaK29t6eK3uVIlRr2Q/LROBB:x9Xa9+JrL5E/st6X+VIlRv/LM3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3280-139-0x0000000004940000-0x0000000004EE4000-memory.dmp

Download

memory/3280-140-0x0000000004EF0000-0x0000000004F82000-memory.dmp

Download

memory/3280-141-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/3280-142-0x0000000005080000-0x000000000511C000-memory.dmp

Download

memory/3280-143-0x0000000005B10000-0x0000000005B76000-memory.dmp

Download

memory/3280-144-0x0000000000810000-0x0000000000860000-memory.dmp

Download

memory/3280-145-0x0000000005DC0000-0x0000000005DCA000-memory.dmp

Download