agenttesla | c6eeabef48a629434a613caade883ec827de3e2061750bbd807df2a3e5c19809

General

Target

edf2482324868bd3843ba4e73258493c.exe
Size

400KB
MD5

edf2482324868bd3843ba4e73258493c
SHA1

63ea0ccb381e1e765ed550c7b39b577f64c5bc48
SHA256

c6eeabef48a629434a613caade883ec827de3e2061750bbd807df2a3e5c19809
SHA512

6b95b11955a025df3dcb1997b206dfe096d9a54eb4a504724c60b932faba705f53c4e621b50438d2ff11594942018ebb356bdd79da0dbfc818cc8e598074cf26
SSDEEP

12288:LYemnabRqoBtSHZp+sv+BW7jyPtdsPGZRae:LYemazSHBqP9

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5661887202:AAEdmGK268nwK3Q0KQ-lOdGhXERPNRUJtz4/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

xfzbh.exexfzbh.exe

pid process

1724 xfzbh.exe
1032 xfzbh.exe
Loads dropped DLL 2 IoCs

Processes:

edf2482324868bd3843ba4e73258493c.exexfzbh.exe

pid process

1996 edf2482324868bd3843ba4e73258493c.exe
1724 xfzbh.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1724	xfzbh.exe
1032	xfzbh.exe

pid	process
1996	edf2482324868bd3843ba4e73258493c.exe
1724	xfzbh.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

xfzbh.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	xfzbh.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	xfzbh.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	xfzbh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

xfzbh.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\miirmmvfb = "C:\\Users\\Admin\\AppData\\Roaming\\vrrbwggplueea\\jffoxttd.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xfzbh.exe\" C:\\Users\\Admin\\AppData\\Loc"	xfzbh.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

xfzbh.exe

description pid process target process

PID 1724 set thread context of 1032 1724 xfzbh.exe xfzbh.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xfzbh.exe

pid process

1724 xfzbh.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

xfzbh.exe

description pid process

Token: SeDebugPrivilege 1032 xfzbh.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

xfzbh.exe

pid process

1032 xfzbh.exe

flow	ioc
3	api.ipify.org
4	api.ipify.org

description	pid	process	target process
PID 1724 set thread context of 1032	1724	xfzbh.exe	xfzbh.exe

pid	process
1724	xfzbh.exe

description	pid	process
Token: SeDebugPrivilege	1032	xfzbh.exe

pid	process
1032	xfzbh.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

edf2482324868bd3843ba4e73258493c.exexfzbh.exe

description	pid	process	target process
PID 1996 wrote to memory of 1724	1996	edf2482324868bd3843ba4e73258493c.exe	xfzbh.exe
PID 1996 wrote to memory of 1724	1996	edf2482324868bd3843ba4e73258493c.exe	xfzbh.exe
PID 1996 wrote to memory of 1724	1996	edf2482324868bd3843ba4e73258493c.exe	xfzbh.exe
PID 1996 wrote to memory of 1724	1996	edf2482324868bd3843ba4e73258493c.exe	xfzbh.exe
PID 1724 wrote to memory of 1032	1724	xfzbh.exe	xfzbh.exe
PID 1724 wrote to memory of 1032	1724	xfzbh.exe	xfzbh.exe
PID 1724 wrote to memory of 1032	1724	xfzbh.exe	xfzbh.exe
PID 1724 wrote to memory of 1032	1724	xfzbh.exe	xfzbh.exe
PID 1724 wrote to memory of 1032	1724	xfzbh.exe	xfzbh.exe

outlook_office_path 1 IoCs

Processes:

xfzbh.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	xfzbh.exe

outlook_win_path 1 IoCs

Processes:

xfzbh.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	xfzbh.exe

C:\Users\Admin\AppData\Local\Temp\edf2482324868bd3843ba4e73258493c.exe
"C:\Users\Admin\AppData\Local\Temp\edf2482324868bd3843ba4e73258493c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\xfzbh.exe
"C:\Users\Admin\AppData\Local\Temp\xfzbh.exe" C:\Users\Admin\AppData\Local\Temp\jspemy.qt
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\xfzbh.exe
"C:\Users\Admin\AppData\Local\Temp\xfzbh.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jspemy.qt

Filesize
7KB

MD5
3926773019a3f2ab0834d45972870963

SHA1
8ac86237a1bf4d5d37e1aa48a467a470ef714508

SHA256
0c21aa1cda8ef133d18784c245f7fa318ce17b9dc68229a4f750a05ad891c802

SHA512
1f66f246c65e02acc91252088487b383001e78e176eccd622c2d9ba944fe2835d1e0e094b9f51d216a37a5e076d162262e383e7b1899f7ed5d4790c8ad2041b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\oynbz.zxh

Filesize
266KB

MD5
1800de52920159770f15dfa35893893e

SHA1
8d3b7e82ceafdb0b3560e02033f24900194117e3

SHA256
8bad231472ce99bbe48777d8c381b7563587e137bba62d88e08d218d849bbf92

SHA512
962cd6697594644513332cff75258227b44d4f19b3d6453e9fd865130139eaf30170d1a9c7579be6f0db9abb0a24ce78598125f66363fa3628171ccfc5d9fc57

Download Submit
C:\Users\Admin\AppData\Local\Temp\xfzbh.exe

Filesize
361KB

MD5
2051a52d6c8e148e037dcf09d9df7015

SHA1
04c5cd0d1cafed7af3474379d9b774e6953c416e

SHA256
417c63ba2b158bafde49f36255b5a28456adfd11b7912178393a40eb3c248839

SHA512
d0bce8c2bed856a3454680adea072a9015fddc1053db6c34b2d3da517cfa0016bce7158a46edf22e16edd1f56eee0cba3ba5b263381e9fd7a79cfa1a484d25c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\xfzbh.exe

Filesize
361KB

MD5
2051a52d6c8e148e037dcf09d9df7015

SHA1
04c5cd0d1cafed7af3474379d9b774e6953c416e

SHA256
417c63ba2b158bafde49f36255b5a28456adfd11b7912178393a40eb3c248839

SHA512
d0bce8c2bed856a3454680adea072a9015fddc1053db6c34b2d3da517cfa0016bce7158a46edf22e16edd1f56eee0cba3ba5b263381e9fd7a79cfa1a484d25c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\xfzbh.exe

Filesize
361KB

MD5
2051a52d6c8e148e037dcf09d9df7015

SHA1
04c5cd0d1cafed7af3474379d9b774e6953c416e

SHA256
417c63ba2b158bafde49f36255b5a28456adfd11b7912178393a40eb3c248839

SHA512
d0bce8c2bed856a3454680adea072a9015fddc1053db6c34b2d3da517cfa0016bce7158a46edf22e16edd1f56eee0cba3ba5b263381e9fd7a79cfa1a484d25c4

Download Submit
\Users\Admin\AppData\Local\Temp\xfzbh.exe

Filesize
361KB

MD5
2051a52d6c8e148e037dcf09d9df7015

SHA1
04c5cd0d1cafed7af3474379d9b774e6953c416e

SHA256
417c63ba2b158bafde49f36255b5a28456adfd11b7912178393a40eb3c248839

SHA512
d0bce8c2bed856a3454680adea072a9015fddc1053db6c34b2d3da517cfa0016bce7158a46edf22e16edd1f56eee0cba3ba5b263381e9fd7a79cfa1a484d25c4

Download Submit
\Users\Admin\AppData\Local\Temp\xfzbh.exe

Filesize
361KB

MD5
2051a52d6c8e148e037dcf09d9df7015

SHA1
04c5cd0d1cafed7af3474379d9b774e6953c416e

SHA256
417c63ba2b158bafde49f36255b5a28456adfd11b7912178393a40eb3c248839

SHA512
d0bce8c2bed856a3454680adea072a9015fddc1053db6c34b2d3da517cfa0016bce7158a46edf22e16edd1f56eee0cba3ba5b263381e9fd7a79cfa1a484d25c4

Download Submit
memory/1032-63-0x0000000000401896-mapping.dmp

Download
memory/1032-66-0x00000000004F0000-0x0000000000520000-memory.dmp

Filesize
192KB

Download
memory/1032-67-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1724-56-0x0000000000000000-mapping.dmp

Download
memory/1996-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads