agenttesla | 3b81d0340e7eb9ad652fbaec10a8392027156a5fb7eb2c6bb3f4d8b851602f99

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2023, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Urgent Price request P.O 1672891FTN.exe
Size 396KB
Sample230208-rlpyjsah31
SHA256 69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541
MD5 af3afdb900624af15bd0984c7c6e236f
SHA1 ecec1c4b32f1c4b7c36a9e1288ca6fc2e0c37e65
SHA512 68665f0412155041c0a1205ed9be133fb1eaf5b15580ffe2e54d24fcd285b2a6dd4cd64cdfd9ef2f4002c9440cac93ef94e0de64f0094775fbdeaa3edd0f3983
SSDEEP 6144:/Ya6q0fMteJiHLKzBBF+JmsGhO5nuJLudiBte7SSjxzBJd2KowUylh3eo0sgVAct:/YMztbH+BBFsms8I+rngJUyP0sgh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
364	exjjiczbi.exe
4860	exjjiczbi.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	exjjiczbi.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	exjjiczbi.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	exjjiczbi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hqmvfbk = "C:\\Users\\Admin\\AppData\\Roaming\\gluqaj\\enwscx.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\exjjiczbi.exe\" C:\\Users\\Admin\\AppData\\Local\\Te"	exjjiczbi.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 364 set thread context of 4860	364	exjjiczbi.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
364	exjjiczbi.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	exjjiczbi.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 364	4952	Urgent Price request P.O 1672891FTN.exe	81
PID 4952 wrote to memory of 364	4952	Urgent Price request P.O 1672891FTN.exe	81
PID 4952 wrote to memory of 364	4952	Urgent Price request P.O 1672891FTN.exe	81
PID 364 wrote to memory of 4860	364	exjjiczbi.exe	82
PID 364 wrote to memory of 4860	364	exjjiczbi.exe	82
PID 364 wrote to memory of 4860	364	exjjiczbi.exe	82
PID 364 wrote to memory of 4860	364	exjjiczbi.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	exjjiczbi.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	exjjiczbi.exe

C:\Users\Admin\AppData\Local\Temp\Urgent Price request P.O 1672891FTN.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent Price request P.O 1672891FTN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\exjjiczbi.exe
  "C:\Users\Admin\AppData\Local\Temp\exjjiczbi.exe" C:\Users\Admin\AppData\Local\Temp\irmixpwf.xy
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Users\Admin\AppData\Local\Temp\exjjiczbi.exe
    "C:\Users\Admin\AppData\Local\Temp\exjjiczbi.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

exjjiczbi.exe

Path C:\Users\Admin\AppData\Local\Temp\exjjiczbi.exe
Size 361KB
SHA256 236b4c73c572a3b7a738aec6ce3d49961873269aa43e6a831448a3ee26a3f7a0
MD5 a38b5641968109193f1890d48f15fb97
SHA1 b23978401200e9f427aa83c87d786653c321e084
SHA512 5aaabb65df420c515415303a2be301ea804c32e16dbf456efee605d1446baed64662d8a1694f9466c497cf809f981f8e0be2e5cf141959b67a8605eec1781eb1
SSDEEP 6144:6WYtu0D9bhoKSoj/QED03mc8+z1zQpb+g47eMF:6WYI0D9bhoK1j/HD03n1zvNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

exjjiczbi.exe

Path C:\Users\Admin\AppData\Local\Temp\exjjiczbi.exe
Size 361KB
SHA256 236b4c73c572a3b7a738aec6ce3d49961873269aa43e6a831448a3ee26a3f7a0
MD5 a38b5641968109193f1890d48f15fb97
SHA1 b23978401200e9f427aa83c87d786653c321e084
SHA512 5aaabb65df420c515415303a2be301ea804c32e16dbf456efee605d1446baed64662d8a1694f9466c497cf809f981f8e0be2e5cf141959b67a8605eec1781eb1
SSDEEP 6144:6WYtu0D9bhoKSoj/QED03mc8+z1zQpb+g47eMF:6WYI0D9bhoK1j/HD03n1zvNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

exjjiczbi.exe

Path C:\Users\Admin\AppData\Local\Temp\exjjiczbi.exe
Size 361KB
SHA256 236b4c73c572a3b7a738aec6ce3d49961873269aa43e6a831448a3ee26a3f7a0
MD5 a38b5641968109193f1890d48f15fb97
SHA1 b23978401200e9f427aa83c87d786653c321e084
SHA512 5aaabb65df420c515415303a2be301ea804c32e16dbf456efee605d1446baed64662d8a1694f9466c497cf809f981f8e0be2e5cf141959b67a8605eec1781eb1
SSDEEP 6144:6WYtu0D9bhoKSoj/QED03mc8+z1zQpb+g47eMF:6WYI0D9bhoK1j/HD03n1zvNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

irmixpwf.xy

Path C:\Users\Admin\AppData\Local\Temp\irmixpwf.xy
Size 7KB
SHA256 2525b54c3807080ea464516c1493be9a752269c71b93b58a2d1a83adaf06d685
MD5 1c1b88824e46dc9ace056c1e79880540
SHA1 a42e6a4ae208641636e78abb54451669c503974c
SHA512 03086f08023442a8128576a110da706b1dc9d7ad334fcba457a06d1d0d37ed9b51e9e20d6781410fdf4e8565d019df953dae871386e655a8be3cd86e3f6add20
SSDEEP 192:darcitQvArWiPvbvb98Ch7QFkwsUDVWaA2ttC8MmLh:uCYrNPvbDoF3sKVTqTm9
MD5 SHA1 SHA512 SSDEEP

Submit Download

kyocn.qdi

Path C:\Users\Admin\AppData\Local\Temp\kyocn.qdi
Size 263KB
SHA256 a84fdad28cb3ea35359c5efcc2ba69e3bead12b0ed4a2664905877233eab7374
MD5 914d7b3d48b112c13badfc7a8058ff5d
SHA1 a4f9dad039092524615fc10575825959a0516b67
SHA512 216ffbb9fdac3aa5d687faefdc04d9607b83801f63c9dffa4a1721b90622b75606124d63a22136f3ce94a9e2abb1e031b163fb4d6922e77c457735eb255283aa
SSDEEP 6144:3CQkffdb8K5QpK4z+ZF4x8mAXzog/MMxuwoCmEyqRsm0F8aAk9r2Ln9owZD/:yQ6fdoSQpKI+L4x8mAXkg08oCmpqHS81
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4860-139-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4860-140-0x0000000005EF0000-0x0000000006494000-memory.dmp

Download

memory/4860-141-0x0000000005940000-0x00000000059A6000-memory.dmp

Download

memory/4860-142-0x00000000067D0000-0x0000000006862000-memory.dmp

Download

memory/4860-143-0x0000000006970000-0x000000000697A000-memory.dmp

Download

memory/4860-144-0x0000000006A00000-0x0000000006A50000-memory.dmp

Download

memory/4860-145-0x0000000006C80000-0x0000000006E42000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads