agenttesla | 1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d

General

Target

1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
Size

350KB
MD5

30de9fdf74e679696573f243be4b43e9
SHA1

013ab418dc36cef10bdafcacc65485a28b292484
SHA256

1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d
SHA512

a137e199ffb4ff001545dd9875571520f41abfb449de7b1435899ca42d133051edc6b7c6bd4309caacc8cfdf98e8c0d3f60241a496cbe74dcb2243a4d24b13a3
SSDEEP

6144:/Ya60B2kYIxjohyIZ9olobwMg0dFr8YrCS0CuneQL50jpjC7XM/FKKnojCqKQBg:/YyB/YwcYWkobwM5uYrP0zeCmjg7XMtR

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.mgcpakistan.com
Port:
21
Username:
[email protected]
Password:
boygirl123456

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

mitzdyntn.exemitzdyntn.exe

pid process

1488 mitzdyntn.exe
1448 mitzdyntn.exe
Loads dropped DLL 2 IoCs

Processes:

1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exemitzdyntn.exe

pid process

1844 1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
1488 mitzdyntn.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1488	mitzdyntn.exe
1448	mitzdyntn.exe

pid	process
1844	1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
1488	mitzdyntn.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

mitzdyntn.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mitzdyntn.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mitzdyntn.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mitzdyntn.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

mitzdyntn.exe

description pid process target process

PID 1488 set thread context of 1448 1488 mitzdyntn.exe mitzdyntn.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

mitzdyntn.exe

pid process

1448 mitzdyntn.exe
1448 mitzdyntn.exe
1448 mitzdyntn.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

mitzdyntn.exe

pid process

1488 mitzdyntn.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mitzdyntn.exe

description pid process

Token: SeDebugPrivilege 1448 mitzdyntn.exe

description	pid	process	target process
PID 1488 set thread context of 1448	1488	mitzdyntn.exe	mitzdyntn.exe

pid	process
1448	mitzdyntn.exe
1448	mitzdyntn.exe
1448	mitzdyntn.exe

pid	process
1488	mitzdyntn.exe

description	pid	process
Token: SeDebugPrivilege	1448	mitzdyntn.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exemitzdyntn.exe

description	pid	process	target process
PID 1844 wrote to memory of 1488	1844	1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe	mitzdyntn.exe
PID 1844 wrote to memory of 1488	1844	1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe	mitzdyntn.exe
PID 1844 wrote to memory of 1488	1844	1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe	mitzdyntn.exe
PID 1844 wrote to memory of 1488	1844	1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe	mitzdyntn.exe
PID 1488 wrote to memory of 1448	1488	mitzdyntn.exe	mitzdyntn.exe
PID 1488 wrote to memory of 1448	1488	mitzdyntn.exe	mitzdyntn.exe
PID 1488 wrote to memory of 1448	1488	mitzdyntn.exe	mitzdyntn.exe
PID 1488 wrote to memory of 1448	1488	mitzdyntn.exe	mitzdyntn.exe
PID 1488 wrote to memory of 1448	1488	mitzdyntn.exe	mitzdyntn.exe

outlook_office_path 1 IoCs

Processes:

mitzdyntn.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mitzdyntn.exe

outlook_win_path 1 IoCs

Processes:

mitzdyntn.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mitzdyntn.exe

C:\Users\Admin\AppData\Local\Temp\1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
"C:\Users\Admin\AppData\Local\Temp\1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844

C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe
"C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe" C:\Users\Admin\AppData\Local\Temp\wadoxpggn.zng
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe
"C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1448

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dsnxlnrgcx.zsm
Filesize
315KB

MD5
394179249883a6361e95ff437b6ed10d

SHA1
a60133e7d2139acde7303752a6830edf0069a324

SHA256
2f2216852c5a57ef8203dc966ce50a6578edc801bd4c294dce1697403325eb90

SHA512
4bc0f56cb4d814c486579983c1d190761702b51a3cd1d4cf871a3c1d1de1be657f7aa791f235e7610d8d340f86789e4f764c79c0a0dce2693fdfb5833d53742d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe
Filesize
112KB

MD5
22714749e5ce66ce2db8b69f0490ecad

SHA1
582afb46417ce3772037dbabe2ca6fd2beeb87fc

SHA256
09a14b18663c0ea5e3706d91204dd7e1379a45698a956b46ea7c4c0ec62a795b

SHA512
5f7e98e5c92382cf820b15d985c4999704d998a3dafa30524675db7a4c5e950854943f11d18d966e7d3a0cb1f20716906b557e7a0fe0dbb5d114fdc67e9d7ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe
Filesize
112KB

MD5
22714749e5ce66ce2db8b69f0490ecad

SHA1
582afb46417ce3772037dbabe2ca6fd2beeb87fc

SHA256
09a14b18663c0ea5e3706d91204dd7e1379a45698a956b46ea7c4c0ec62a795b

SHA512
5f7e98e5c92382cf820b15d985c4999704d998a3dafa30524675db7a4c5e950854943f11d18d966e7d3a0cb1f20716906b557e7a0fe0dbb5d114fdc67e9d7ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe
Filesize
112KB

MD5
22714749e5ce66ce2db8b69f0490ecad

SHA1
582afb46417ce3772037dbabe2ca6fd2beeb87fc

SHA256
09a14b18663c0ea5e3706d91204dd7e1379a45698a956b46ea7c4c0ec62a795b

SHA512
5f7e98e5c92382cf820b15d985c4999704d998a3dafa30524675db7a4c5e950854943f11d18d966e7d3a0cb1f20716906b557e7a0fe0dbb5d114fdc67e9d7ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wadoxpggn.zng
Filesize
5KB

MD5
1b854cc4df1b85317c7f6b12ddcefcab

SHA1
c0e68cf12fe1ed7b716a00dea59f7e36f5891fa5

SHA256
36706e32792b682edc9a4a8c8f9bec2784b730c9a182ea083f04c78edc31d261

SHA512
b7f3f3f39e9af2f717d203a25ae7cd5d66dd3a3e745d51e72ea1b0c0a53946221b0c54fc83e3c89984f99b7fadc22193c92b316eaac5bc8704296f5ad4256024

Download Submit
\Users\Admin\AppData\Local\Temp\mitzdyntn.exe
Filesize
112KB

MD5
22714749e5ce66ce2db8b69f0490ecad

SHA1
582afb46417ce3772037dbabe2ca6fd2beeb87fc

SHA256
09a14b18663c0ea5e3706d91204dd7e1379a45698a956b46ea7c4c0ec62a795b

SHA512
5f7e98e5c92382cf820b15d985c4999704d998a3dafa30524675db7a4c5e950854943f11d18d966e7d3a0cb1f20716906b557e7a0fe0dbb5d114fdc67e9d7ae2

Download Submit
\Users\Admin\AppData\Local\Temp\mitzdyntn.exe
Filesize
112KB

MD5
22714749e5ce66ce2db8b69f0490ecad

SHA1
582afb46417ce3772037dbabe2ca6fd2beeb87fc

SHA256
09a14b18663c0ea5e3706d91204dd7e1379a45698a956b46ea7c4c0ec62a795b

SHA512
5f7e98e5c92382cf820b15d985c4999704d998a3dafa30524675db7a4c5e950854943f11d18d966e7d3a0cb1f20716906b557e7a0fe0dbb5d114fdc67e9d7ae2

Download Submit
memory/1448-63-0x0000000000401896-mapping.dmp

Download
memory/1448-66-0x00000000044D0000-0x000000000450C000-memory.dmp

Filesize
240KB

Download
memory/1448-67-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1488-56-0x0000000000000000-mapping.dmp

Download
memory/1844-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads