agenttesla | fa851cb6401d335ba0efbeac4916ef565963723f68c939a772e28866c3863e9c

Analysis

max time kernel
108s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2023, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swift copy.exe
Size 323KB
Sample230215-rtkc2acb72
SHA256 fa851cb6401d335ba0efbeac4916ef565963723f68c939a772e28866c3863e9c
MD5 067e049672e7d1e7ab5415eaba7f25b9
SHA1 b08f41e13114c4f624a4e8e03f70292b8a6dd660
SHA512 98707c2384bbda9ede1861e0bd508a9797ce498eaed8feecae562c222dc517fc3463a4de2b789c9c98d2b7dbf1c33aa42225e04dc3f1f9574c9a16b234828524
SSDEEP 6144:PYa6S9DxztixRxla8gnMFplXrquXN/ol9bpMEBIX0TLCWiC36Aa:PYM9DxwxRT3HprHXN/2b2z6+Wkb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2080	mynkx.exe
2392	mynkx.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mynkx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mynkx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mynkx.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mvrbkgplu = "C:\\Users\\Admin\\AppData\\Roaming\\rnwgclu\\qauenjscxhd.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\mynkx.exe\" C:\\Users\\Admin\\AppData\\Local\\"	mynkx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VvcPRR = "C:\\Users\\Admin\\AppData\\Roaming\\VvcPRR\\VvcPRR.exe"	mynkx.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	api.ipify.org
12	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 2392	2080	mynkx.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2080	mynkx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	mynkx.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2080	4712	swift copy.exe	79
PID 4712 wrote to memory of 2080	4712	swift copy.exe	79
PID 4712 wrote to memory of 2080	4712	swift copy.exe	79
PID 2080 wrote to memory of 2392	2080	mynkx.exe	80
PID 2080 wrote to memory of 2392	2080	mynkx.exe	80
PID 2080 wrote to memory of 2392	2080	mynkx.exe	80
PID 2080 wrote to memory of 2392	2080	mynkx.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mynkx.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mynkx.exe

C:\Users\Admin\AppData\Local\Temp\swift copy.exe
"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\mynkx.exe
  "C:\Users\Admin\AppData\Local\Temp\mynkx.exe" C:\Users\Admin\AppData\Local\Temp\xhmrwolg.qki
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\mynkx.exe
    "C:\Users\Admin\AppData\Local\Temp\mynkx.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

llasu.mv

Path C:\Users\Admin\AppData\Local\Temp\llasu.mv
Size 263KB
SHA256 874d8911ac86bbaf27dd4d9d6553446c6b32362c3b55a4de73525bf19d6c6de6
MD5 7510cf56892c5bdd4a8931847c8c2cad
SHA1 4518b62ed0b2c59c01aef0e09783edcff30991c4
SHA512 46d17433fcd0b499ba534106aac7967e3f5ea36991d0f0f6354869e5cfa1f0b6e40f608e0c90c5dee4c239d70280c522c5927dcea335834432a133bc0385f617
SSDEEP 6144:IoYvk4UTUn9dIZ0oFb+Pi/72m/qe0XZUFHVRO:IoYMNTQ9KZnFb+P87iuVRO
MD5 SHA1 SHA512 SSDEEP

Submit Download

mynkx.exe

Path C:\Users\Admin\AppData\Local\Temp\mynkx.exe
Size 139KB
SHA256 1513d2b986fd5c50654d54de1cfb84b9190afde536775ef2083ef60333f4fbb7
MD5 b1bde34270a57b69e0b0a821f1eb6ba4
SHA1 1e49c2440128a0a373cee07d2c78f7e1e2c371e1
SHA512 f10831e0f61c47488967981b4f6bc1e256223525e003d1921cce4225d8881bb63132632574c783e690240f67cba0e748679e579f9bd122ac1aa3cdc4d344d997
SSDEEP 1536:EfXL2BPX5ws7o9oMeTsIpGq0g2izcZZzD0vLF5rWGINOsuPOnW/0yBtEFt2x:EfXLoo2TM1ZZzgvLF5rpIN8OW/zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mynkx.exe

Path C:\Users\Admin\AppData\Local\Temp\mynkx.exe
Size 139KB
SHA256 1513d2b986fd5c50654d54de1cfb84b9190afde536775ef2083ef60333f4fbb7
MD5 b1bde34270a57b69e0b0a821f1eb6ba4
SHA1 1e49c2440128a0a373cee07d2c78f7e1e2c371e1
SHA512 f10831e0f61c47488967981b4f6bc1e256223525e003d1921cce4225d8881bb63132632574c783e690240f67cba0e748679e579f9bd122ac1aa3cdc4d344d997
SSDEEP 1536:EfXL2BPX5ws7o9oMeTsIpGq0g2izcZZzD0vLF5rWGINOsuPOnW/0yBtEFt2x:EfXLoo2TM1ZZzgvLF5rpIN8OW/zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mynkx.exe

Path C:\Users\Admin\AppData\Local\Temp\mynkx.exe
Size 139KB
SHA256 1513d2b986fd5c50654d54de1cfb84b9190afde536775ef2083ef60333f4fbb7
MD5 b1bde34270a57b69e0b0a821f1eb6ba4
SHA1 1e49c2440128a0a373cee07d2c78f7e1e2c371e1
SHA512 f10831e0f61c47488967981b4f6bc1e256223525e003d1921cce4225d8881bb63132632574c783e690240f67cba0e748679e579f9bd122ac1aa3cdc4d344d997
SSDEEP 1536:EfXL2BPX5ws7o9oMeTsIpGq0g2izcZZzD0vLF5rWGINOsuPOnW/0yBtEFt2x:EfXLoo2TM1ZZzgvLF5rpIN8OW/zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

xhmrwolg.qki

Path C:\Users\Admin\AppData\Local\Temp\xhmrwolg.qki
Size 7KB
SHA256 595d30f9893992e95c9cf8780e7570fdee3ac1ae360d1c570d869aa816972cae
MD5 7ac42e47f499cde79e276bfed3b9893c
SHA1 dff50c163307f4f05eaf392992b89885f35d58d1
SHA512 5aecb9d62de7128598e87120a81decd738b13517575433f31dc2da8a5ed4bd38dc6615d24a6b8eb7d52b4b5a6c1a42fc8aad685f9dcd61b82f573e409ecd36ea
SSDEEP 192:darcitQvArWiPvqJb9yIwsLHhCCrsyW9v6sLtNI7ypzV:uCYrNPvqNUKLHrrsD6iNI7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2392-139-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2392-140-0x0000000005CE0000-0x0000000006284000-memory.dmp

Download

memory/2392-141-0x0000000005680000-0x00000000056E6000-memory.dmp

Download

memory/2392-142-0x0000000006E50000-0x0000000006EE2000-memory.dmp

Download

memory/2392-143-0x0000000006E00000-0x0000000006E0A000-memory.dmp

Download

memory/2392-144-0x0000000007040000-0x0000000007090000-memory.dmp

Download

memory/2392-145-0x00000000073B0000-0x0000000007572000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads