agenttesla | 2f64531d71dd54c1e57e33a70a8b019bfb7997a2552f1b4ec63ce80bc6b07fff

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28/02/2023, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SO# A56DX04471 JOB#SZYC23021891.exe
Size 324KB
Sample230228-rtkc2abg62
SHA256 2f64531d71dd54c1e57e33a70a8b019bfb7997a2552f1b4ec63ce80bc6b07fff
MD5 2f84568242e6fda6ea1b2b0a581b000e
SHA1 5b96fb8fd4d682897c8657ccb8fa1bb0f0a0c3c3
SHA512 5ddbef89d32d4888a89b12e248c13a2ecfb28abd213dd0bed1e6624078f50f693c5471ae2488045c2cfee48e7cf578cbb82b45a5f5331d83d2c08ccef48ead94
SSDEEP 6144:/Ya6eiv2L9gsAOdUddh5w+9jKm6IDN65PBIKmu8qdcQ6mUaB7betsIvi91:/YIivnO6dr+NB6+Vn6/a55F3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
852	dscdceaxog.exe
1048	dscdceaxog.exe

Loads dropped DLL 2 IoCs

pid	Process
1392	SO# A56DX04471 JOB#SZYC23021891.exe
852	dscdceaxog.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dscdceaxog.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dscdceaxog.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dscdceaxog.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 852 set thread context of 1048	852	dscdceaxog.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
852	dscdceaxog.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	dscdceaxog.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 852	1392	SO# A56DX04471 JOB#SZYC23021891.exe	28
PID 1392 wrote to memory of 852	1392	SO# A56DX04471 JOB#SZYC23021891.exe	28
PID 1392 wrote to memory of 852	1392	SO# A56DX04471 JOB#SZYC23021891.exe	28
PID 1392 wrote to memory of 852	1392	SO# A56DX04471 JOB#SZYC23021891.exe	28
PID 852 wrote to memory of 1048	852	dscdceaxog.exe	29
PID 852 wrote to memory of 1048	852	dscdceaxog.exe	29
PID 852 wrote to memory of 1048	852	dscdceaxog.exe	29
PID 852 wrote to memory of 1048	852	dscdceaxog.exe	29
PID 852 wrote to memory of 1048	852	dscdceaxog.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dscdceaxog.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dscdceaxog.exe

C:\Users\Admin\AppData\Local\Temp\SO# A56DX04471 JOB#SZYC23021891.exe
"C:\Users\Admin\AppData\Local\Temp\SO# A56DX04471 JOB#SZYC23021891.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\dscdceaxog.exe
  "C:\Users\Admin\AppData\Local\Temp\dscdceaxog.exe" C:\Users\Admin\AppData\Local\Temp\tswiwc.p
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Users\Admin\AppData\Local\Temp\dscdceaxog.exe
    "C:\Users\Admin\AppData\Local\Temp\dscdceaxog.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dscdceaxog.exe

Path C:\Users\Admin\AppData\Local\Temp\dscdceaxog.exe
Size 130KB
SHA256 82645a9f093f549e3f25c2e97d390afc48ad2c40f3d2abe6fc3a74c9b81d60ae
MD5 4e76fc0281a338b5f7fed62c02be24d8
SHA1 0763d4c2cd24ad07aaa62e0810259382aeafd590
SHA512 a8bb0234c61eabcd2848c3c35bde0744bc2739cf8cbe5418626a20cff19139d9da2a5a7bf9b755592a773db84f602bd8009e38bc2e36a1fd01070ede88879e9d
SSDEEP 3072:hLseRYR/m1B6SIzzHjh6i8DDARGEuIae1u+bJWSh+1OCEuc9fTzhRfiFG/wHrN4y:/YR/m1BAzzZ8LID4qcShScflhIF6oWFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dscdceaxog.exe

Path C:\Users\Admin\AppData\Local\Temp\dscdceaxog.exe
Size 130KB
SHA256 82645a9f093f549e3f25c2e97d390afc48ad2c40f3d2abe6fc3a74c9b81d60ae
MD5 4e76fc0281a338b5f7fed62c02be24d8
SHA1 0763d4c2cd24ad07aaa62e0810259382aeafd590
SHA512 a8bb0234c61eabcd2848c3c35bde0744bc2739cf8cbe5418626a20cff19139d9da2a5a7bf9b755592a773db84f602bd8009e38bc2e36a1fd01070ede88879e9d
SSDEEP 3072:hLseRYR/m1B6SIzzHjh6i8DDARGEuIae1u+bJWSh+1OCEuc9fTzhRfiFG/wHrN4y:/YR/m1BAzzZ8LID4qcShScflhIF6oWFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dscdceaxog.exe

Path C:\Users\Admin\AppData\Local\Temp\dscdceaxog.exe
Size 130KB
SHA256 82645a9f093f549e3f25c2e97d390afc48ad2c40f3d2abe6fc3a74c9b81d60ae
MD5 4e76fc0281a338b5f7fed62c02be24d8
SHA1 0763d4c2cd24ad07aaa62e0810259382aeafd590
SHA512 a8bb0234c61eabcd2848c3c35bde0744bc2739cf8cbe5418626a20cff19139d9da2a5a7bf9b755592a773db84f602bd8009e38bc2e36a1fd01070ede88879e9d
SSDEEP 3072:hLseRYR/m1B6SIzzHjh6i8DDARGEuIae1u+bJWSh+1OCEuc9fTzhRfiFG/wHrN4y:/YR/m1BAzzZ8LID4qcShScflhIF6oWFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsjtthvu.uq

Path C:\Users\Admin\AppData\Local\Temp\tsjtthvu.uq
Size 262KB
SHA256 8a5d050cb3a5d22702fffe480242cc76e8b512caa5416ec602c6c31f38d30a4f
MD5 99277efae35a670da0f30bc6c3609fa0
SHA1 18904ab267468c3086d1d3d7276c25b03fedbce4
SHA512 9590f7940875a7e86e390ef45e00ed12e575172a77dc6f1fb2433799b40b5bd7d6eeb7e1d155078c8e30657d4d785493e26118b3a563c8594488a75fa9dac8c9
SSDEEP 6144:GmvEW/YqKr9vU+AZ0v1DEXM68l9MIDkugAn6su5:LMkYrS+lpE4LMsrv6s0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tswiwc.p

Path C:\Users\Admin\AppData\Local\Temp\tswiwc.p
Size 5KB
SHA256 6ca3677062fd154dc4f06b4ee63cce39fb9bcd490ba844821ad37ee8a837e46c
MD5 1cc8aba5573bb24bf86bec22ccaa5268
SHA1 d4d4796afdc1737df66190685fbb7fc0f1ffed58
SHA512 706a73b50853ce020152a63004ea4a7e1fc72450b12855e3c60eb482b7a2f6964679f16be9f2af3f6e87b0cc8cd86aea134356ba2c2965e92fde5ce2d01279a1
SSDEEP 96:Farc6oYAg/DrYuCk2XO5oSwYo9NvGrhUZdQ2dSdQ4dbEKhqpISIx4T2gOcuwIFch:FarcR0KhX1S92WUjQ6uQQ6Ixzgu1c3mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dscdceaxog.exe

Path \Users\Admin\AppData\Local\Temp\dscdceaxog.exe
Size 130KB
SHA256 82645a9f093f549e3f25c2e97d390afc48ad2c40f3d2abe6fc3a74c9b81d60ae
MD5 4e76fc0281a338b5f7fed62c02be24d8
SHA1 0763d4c2cd24ad07aaa62e0810259382aeafd590
SHA512 a8bb0234c61eabcd2848c3c35bde0744bc2739cf8cbe5418626a20cff19139d9da2a5a7bf9b755592a773db84f602bd8009e38bc2e36a1fd01070ede88879e9d
SSDEEP 3072:hLseRYR/m1B6SIzzHjh6i8DDARGEuIae1u+bJWSh+1OCEuc9fTzhRfiFG/wHrN4y:/YR/m1BAzzZ8LID4qcShScflhIF6oWFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dscdceaxog.exe

Path \Users\Admin\AppData\Local\Temp\dscdceaxog.exe
Size 130KB
SHA256 82645a9f093f549e3f25c2e97d390afc48ad2c40f3d2abe6fc3a74c9b81d60ae
MD5 4e76fc0281a338b5f7fed62c02be24d8
SHA1 0763d4c2cd24ad07aaa62e0810259382aeafd590
SHA512 a8bb0234c61eabcd2848c3c35bde0744bc2739cf8cbe5418626a20cff19139d9da2a5a7bf9b755592a773db84f602bd8009e38bc2e36a1fd01070ede88879e9d
SSDEEP 3072:hLseRYR/m1B6SIzzHjh6i8DDARGEuIae1u+bJWSh+1OCEuc9fTzhRfiFG/wHrN4y:/YR/m1BAzzZ8LID4qcShScflhIF6oWFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-66-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1048-70-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1048-71-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1048-72-0x0000000001E00000-0x0000000001E30000-memory.dmp

Download

memory/1048-73-0x00000000045B0000-0x00000000045F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads