agenttesla | ecb753038c8cf2e221ad6f94bb95fcfbac4d555103fe5deb2c425c0eeb32921d

Analysis

max time kernel
65s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2023, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PAYMENT INVOICE.exe
Size 321KB
Sample230215-rrbm4scb59
SHA256 02cb460ba00233079c5d54b45aeaefe8000d5fd14da7c25f86ef2606587fc4db
MD5 a8fe01a374690767e9e37df662706fca
SHA1 b28c7eca20c1cd30ce559f55b6e7b3f5c8d7d9ee
SHA512 5ce4a3141985c10f40adb6c95ad57aa9b1ead4aac943f615ffabb4d6272acb91ed86abde254bb1a799828e9f8e5662c4cca3aeddc5da2af282a1be023c8c6bdd
SSDEEP 6144:PYa6hsusOT6r/NG4aQCoPaAodQ0MfQxsByFzOz8EM/tHLe7XB/qcoXNghN1xZ:PYrRsEEbCzxdOy1I1UtHLcNqcoduL7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
4860	gtfru.exe
5088	gtfru.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtfru.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtfru.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtfru.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 5088	4860	gtfru.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4860	gtfru.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	gtfru.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4860	4912	PAYMENT INVOICE.exe	82
PID 4912 wrote to memory of 4860	4912	PAYMENT INVOICE.exe	82
PID 4912 wrote to memory of 4860	4912	PAYMENT INVOICE.exe	82
PID 4860 wrote to memory of 5088	4860	gtfru.exe	83
PID 4860 wrote to memory of 5088	4860	gtfru.exe	83
PID 4860 wrote to memory of 5088	4860	gtfru.exe	83
PID 4860 wrote to memory of 5088	4860	gtfru.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtfru.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtfru.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT INVOICE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\gtfru.exe
  "C:\Users\Admin\AppData\Local\Temp\gtfru.exe" C:\Users\Admin\AppData\Local\Temp\pizofcp.eup
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\gtfru.exe
    "C:\Users\Admin\AppData\Local\Temp\gtfru.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:5088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gtfru.exe

Path C:\Users\Admin\AppData\Local\Temp\gtfru.exe
Size 139KB
SHA256 839f0631951b319176fe67bca43de293a7d280733dd68bba7d2d328b42100c12
MD5 e59edcb9d1dd6eb9ad788c31037491c0
SHA1 acae5b5df718e6081368e104a4eff20b35a0da06
SHA512 804cbf39f7f2cb94c6855ec8fd3220f1d123b94b60619986183eeddb6ab75c1ced5fa6b6b5116459ea49568ecba9d29e5f4eb01adc812f71b61acd4b0bc43a5b
SSDEEP 1536:ofXL2BPX5ws7o9oMeTsIpGq0g2izcZZzD0vLF5rWGINOsuPOnW/0yBtEFt2x:ofXLoo2TM1ZZzgvLF5rpIN8OW/zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtfru.exe

Path C:\Users\Admin\AppData\Local\Temp\gtfru.exe
Size 139KB
SHA256 839f0631951b319176fe67bca43de293a7d280733dd68bba7d2d328b42100c12
MD5 e59edcb9d1dd6eb9ad788c31037491c0
SHA1 acae5b5df718e6081368e104a4eff20b35a0da06
SHA512 804cbf39f7f2cb94c6855ec8fd3220f1d123b94b60619986183eeddb6ab75c1ced5fa6b6b5116459ea49568ecba9d29e5f4eb01adc812f71b61acd4b0bc43a5b
SSDEEP 1536:ofXL2BPX5ws7o9oMeTsIpGq0g2izcZZzD0vLF5rWGINOsuPOnW/0yBtEFt2x:ofXLoo2TM1ZZzgvLF5rpIN8OW/zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtfru.exe

Path C:\Users\Admin\AppData\Local\Temp\gtfru.exe
Size 139KB
SHA256 839f0631951b319176fe67bca43de293a7d280733dd68bba7d2d328b42100c12
MD5 e59edcb9d1dd6eb9ad788c31037491c0
SHA1 acae5b5df718e6081368e104a4eff20b35a0da06
SHA512 804cbf39f7f2cb94c6855ec8fd3220f1d123b94b60619986183eeddb6ab75c1ced5fa6b6b5116459ea49568ecba9d29e5f4eb01adc812f71b61acd4b0bc43a5b
SSDEEP 1536:ofXL2BPX5ws7o9oMeTsIpGq0g2izcZZzD0vLF5rWGINOsuPOnW/0yBtEFt2x:ofXLoo2TM1ZZzgvLF5rpIN8OW/zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

lomykjg.c

Path C:\Users\Admin\AppData\Local\Temp\lomykjg.c
Size 262KB
SHA256 c4dbe879dc39c68eb2bf4349043e649cf255cd52395fab76e12fe98e3db2cbd2
MD5 e2e2886a277ee8eada933af039491c49
SHA1 e09af6763256f17bb9913f25f32239e480a28dec
SHA512 08b89c43b2393cd7d31e7d85f495528d31c5ce746143c81b5a223054939bfbef622da1941edf89ef07bbacd0ac3a58b355dd4a38283676639fe9396e663a4232
SSDEEP 6144:ibL5y5cRY80QeH5ha4GArz4rLgxezZdtsByGjp68t/YWp:ibL56ciiA34vgs9dtmp6UYc
MD5 SHA1 SHA512 SSDEEP

Submit Download

pizofcp.eup

Path C:\Users\Admin\AppData\Local\Temp\pizofcp.eup
Size 5KB
SHA256 2441e04b7a3e058b0f058086e2c2b8c4cdd184c91f427782ec01e59157c0faef
MD5 799a0a31bd1c05ca39f356c979cdc166
SHA1 da27860bcd1e59bbc410c21eb5bfed5b1c063bbe
SHA512 569cfd292838b6f8780edccee9c0817c40fa9755dd045eabb1b067109ca6d6749175ec59d0fb3690e9b7dd368f47c8deb37b0c644a1ccb859d15267b04c33638
SSDEEP 96:Farc6oYZg/DrYuXk2XO5oSw0Wvssb7XdPxykwKOW8CcSlKR81DJi6p:FarcRVfhX1SJqnftkkw/ZS1D7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5088-139-0x0000000005800000-0x0000000005DA4000-memory.dmp

Download

memory/5088-140-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5088-141-0x0000000005320000-0x0000000005386000-memory.dmp

Download

memory/5088-142-0x00000000061E0000-0x0000000006272000-memory.dmp

Download

memory/5088-143-0x00000000061D0000-0x00000000061DA000-memory.dmp

Download

memory/5088-144-0x0000000006330000-0x0000000006380000-memory.dmp

Download

memory/5088-145-0x0000000006750000-0x0000000006912000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads