agenttesla | f246a2928ff4385319ee284a0da694797eb0329423b2ac35a5bc468d56d43263

Analysis

max time kernel
160s
max time network
248s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09/02/2023, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PAYMENT SLIP_002_JPEG.exe
Size 333KB
Sample230209-e9dtzace39
SHA256 f246a2928ff4385319ee284a0da694797eb0329423b2ac35a5bc468d56d43263
MD5 a1d6fd5700ea9b5446968ece7376c741
SHA1 636a6f3ba98e90f66415764980674c4b8929ded5
SHA512 ac8ef2d39e8db2405faa54236c5b06ee80d1b2a58baa2f4da77e2f1eea07ddd029985c6969cc187a78882cb554a5a0a4f798d7087cb26a09656228ffc82c21a0
SSDEEP 6144:iYa6FoaKCrRlgv45iYdI/t1gpBtVlIGi0Wre4FZBGGpAQ9jGY5:iY4aKCRyg5zIiBtVlMLrBgEN7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.ravv.sk
Port
587
Username
[email protected]
Password
bfE#vKaMi#

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.ravv.sk
Port
587
Username
[email protected]
Password
bfE#vKaMi#
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
772	dhwggtgy.exe
780	dhwggtgy.exe

Loads dropped DLL 3 IoCs

pid	Process
592	PAYMENT SLIP_002_JPEG.exe
592	PAYMENT SLIP_002_JPEG.exe
772	dhwggtgy.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dhwggtgy.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dhwggtgy.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dhwggtgy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 772 set thread context of 780	772	dhwggtgy.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
772	dhwggtgy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	dhwggtgy.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 772	592	PAYMENT SLIP_002_JPEG.exe	28
PID 592 wrote to memory of 772	592	PAYMENT SLIP_002_JPEG.exe	28
PID 592 wrote to memory of 772	592	PAYMENT SLIP_002_JPEG.exe	28
PID 592 wrote to memory of 772	592	PAYMENT SLIP_002_JPEG.exe	28
PID 772 wrote to memory of 780	772	dhwggtgy.exe	29
PID 772 wrote to memory of 780	772	dhwggtgy.exe	29
PID 772 wrote to memory of 780	772	dhwggtgy.exe	29
PID 772 wrote to memory of 780	772	dhwggtgy.exe	29
PID 772 wrote to memory of 780	772	dhwggtgy.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dhwggtgy.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dhwggtgy.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENT SLIP_002_JPEG.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT SLIP_002_JPEG.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592
- C:\Users\Admin\AppData\Local\Temp\dhwggtgy.exe
  "C:\Users\Admin\AppData\Local\Temp\dhwggtgy.exe" C:\Users\Admin\AppData\Local\Temp\errciw.h
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Users\Admin\AppData\Local\Temp\dhwggtgy.exe
    "C:\Users\Admin\AppData\Local\Temp\dhwggtgy.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dhwggtgy.exe

Path C:\Users\Admin\AppData\Local\Temp\dhwggtgy.exe
Size 120KB
SHA256 89d74bb2c59e9243a793818d6129fdcbddce86bdf90021a7abbbf9301fbe9dd2
MD5 927c6fec987e174aa03ce8e1464101a5
SHA1 fac509b17bcf2d7d10d6c373fee51f56a2d27fda
SHA512 5f61a305e9b323fe01faa5fee8b2a0cf5cd4708388273a560583b3459380b985ab97cd6c25e75ca97d1d40604b3ad88dd30fc97c4ad3147cc5357b95daaf260e
SSDEEP 1536:Y4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:lZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhwggtgy.exe

Path C:\Users\Admin\AppData\Local\Temp\dhwggtgy.exe
Size 120KB
SHA256 89d74bb2c59e9243a793818d6129fdcbddce86bdf90021a7abbbf9301fbe9dd2
MD5 927c6fec987e174aa03ce8e1464101a5
SHA1 fac509b17bcf2d7d10d6c373fee51f56a2d27fda
SHA512 5f61a305e9b323fe01faa5fee8b2a0cf5cd4708388273a560583b3459380b985ab97cd6c25e75ca97d1d40604b3ad88dd30fc97c4ad3147cc5357b95daaf260e
SSDEEP 1536:Y4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:lZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhwggtgy.exe

Path C:\Users\Admin\AppData\Local\Temp\dhwggtgy.exe
Size 120KB
SHA256 89d74bb2c59e9243a793818d6129fdcbddce86bdf90021a7abbbf9301fbe9dd2
MD5 927c6fec987e174aa03ce8e1464101a5
SHA1 fac509b17bcf2d7d10d6c373fee51f56a2d27fda
SHA512 5f61a305e9b323fe01faa5fee8b2a0cf5cd4708388273a560583b3459380b985ab97cd6c25e75ca97d1d40604b3ad88dd30fc97c4ad3147cc5357b95daaf260e
SSDEEP 1536:Y4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:lZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

errciw.h

Path C:\Users\Admin\AppData\Local\Temp\errciw.h
Size 5KB
SHA256 922ce2b7927c2a746c5f45dee356f74978ec5124bb3aba1978d3b235c0219eb8
MD5 0da49731fbdd2d6bd8d7bf91780d7929
SHA1 75856753d6e4f419a531e876ee4b3f6b23b2638d
SHA512 1c4613f31677944558f34b4aab8b43c14336baff71132514729843a48473cd2ca20b31d7beca6df5245bfc0008205a40f827f53993d1ea255a83a432f90245d2
SSDEEP 96:Farc6oYQg/DrYutk2XO5oSwgr5vRcd3/FKxVH9PlQQfqZRfuLfiUvUX7fT0IscE+:FarcR0VhX1SlNps3/MxVrQBvfuLnvUXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

hewsc.o

Path C:\Users\Admin\AppData\Local\Temp\hewsc.o
Size 265KB
SHA256 d88e8411becdd560d5c3b18eac493318f57cc61e259aa2344405f9f2cdba1610
MD5 b37bdd96fc2714ad66f5d1a6d88bd3a4
SHA1 e8a0ce89a4879c581ed6bb659e44367ec4cf3420
SHA512 0896679bbd16b8b5a951af208c1def34e1cdbf6f65b1d9f4ce96064bca8f5c9d2946c7fb844d9499f73a24d80a3572becbfcd39ff3c6333751787f7485998426
SSDEEP 6144:k4Qeh9idCcMYCACG/LA3q9LBIhtasIVjB/duKGxp1IM:k4Qe09HTWilIhtJkB/YfxpKM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhwggtgy.exe

Path \Users\Admin\AppData\Local\Temp\dhwggtgy.exe
Size 120KB
SHA256 89d74bb2c59e9243a793818d6129fdcbddce86bdf90021a7abbbf9301fbe9dd2
MD5 927c6fec987e174aa03ce8e1464101a5
SHA1 fac509b17bcf2d7d10d6c373fee51f56a2d27fda
SHA512 5f61a305e9b323fe01faa5fee8b2a0cf5cd4708388273a560583b3459380b985ab97cd6c25e75ca97d1d40604b3ad88dd30fc97c4ad3147cc5357b95daaf260e
SSDEEP 1536:Y4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:lZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhwggtgy.exe

Path \Users\Admin\AppData\Local\Temp\dhwggtgy.exe
Size 120KB
SHA256 89d74bb2c59e9243a793818d6129fdcbddce86bdf90021a7abbbf9301fbe9dd2
MD5 927c6fec987e174aa03ce8e1464101a5
SHA1 fac509b17bcf2d7d10d6c373fee51f56a2d27fda
SHA512 5f61a305e9b323fe01faa5fee8b2a0cf5cd4708388273a560583b3459380b985ab97cd6c25e75ca97d1d40604b3ad88dd30fc97c4ad3147cc5357b95daaf260e
SSDEEP 1536:Y4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:lZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhwggtgy.exe

Path \Users\Admin\AppData\Local\Temp\dhwggtgy.exe
Size 120KB
SHA256 89d74bb2c59e9243a793818d6129fdcbddce86bdf90021a7abbbf9301fbe9dd2
MD5 927c6fec987e174aa03ce8e1464101a5
SHA1 fac509b17bcf2d7d10d6c373fee51f56a2d27fda
SHA512 5f61a305e9b323fe01faa5fee8b2a0cf5cd4708388273a560583b3459380b985ab97cd6c25e75ca97d1d40604b3ad88dd30fc97c4ad3147cc5357b95daaf260e
SSDEEP 1536:Y4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:lZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/592-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Download

memory/780-66-0x00000000001B0000-0x00000000001E0000-memory.dmp

Download

memory/780-67-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads