agenttesla | 51d790b7e7c7e1f1bf83e0c7f94dfe682ec48e6afeeaa61b0b0db7f8f187ea29

Analysis

max time kernel
30s
max time network
138s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/03/2023, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4018695.exe
Size 329KB
Sample230302-mpdbpsce58
SHA256 51d790b7e7c7e1f1bf83e0c7f94dfe682ec48e6afeeaa61b0b0db7f8f187ea29
MD5 9e0039c142dd9ff79b54b250ded6b4c6
SHA1 78d46123fb84e0e13d55054e3eed47dbb4cc078f
SHA512 811bdbea73ab422aebcb91ccc3761bf8ca2ac0e3023d93773e847d29af05734651186af38dd5ac9e847cc2767309f24a4aa7acda10806d23023a6a4840f69afb
SSDEEP 6144:vYa628Q/c+a9T3rGYJvAz9DODsfmlEjp3JxKzSjziII5QdM:vYY8p+a9T6jzmsOCjp5xKzRIX+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
1620	valglsrdh.exe
320	valglsrdh.exe

Loads dropped DLL 3 IoCs

pid	Process
1040	4018695.exe
1040	4018695.exe
1620	valglsrdh.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	valglsrdh.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	valglsrdh.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	valglsrdh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\irnwgbk = "C:\\Users\\Admin\\AppData\\Roaming\\vfoktpyienwsc\\wgplueajfoxtdm.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\valglsrdh.exe\" C:\\Users\\Admin\\A"	valglsrdh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\VvcPRR = "C:\\Users\\Admin\\AppData\\Roaming\\VvcPRR\\VvcPRR.exe"	valglsrdh.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 320	1620	valglsrdh.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1620	valglsrdh.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	valglsrdh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1620	1040	4018695.exe	27
PID 1040 wrote to memory of 1620	1040	4018695.exe	27
PID 1040 wrote to memory of 1620	1040	4018695.exe	27
PID 1040 wrote to memory of 1620	1040	4018695.exe	27
PID 1620 wrote to memory of 320	1620	valglsrdh.exe	29
PID 1620 wrote to memory of 320	1620	valglsrdh.exe	29
PID 1620 wrote to memory of 320	1620	valglsrdh.exe	29
PID 1620 wrote to memory of 320	1620	valglsrdh.exe	29
PID 1620 wrote to memory of 320	1620	valglsrdh.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	valglsrdh.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	valglsrdh.exe

C:\Users\Admin\AppData\Local\Temp\4018695.exe
"C:\Users\Admin\AppData\Local\Temp\4018695.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\valglsrdh.exe
  "C:\Users\Admin\AppData\Local\Temp\valglsrdh.exe" C:\Users\Admin\AppData\Local\Temp\xwwpxekuvi.zbe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\valglsrdh.exe
    "C:\Users\Admin\AppData\Local\Temp\valglsrdh.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

szuvdd.zm

Path C:\Users\Admin\AppData\Local\Temp\szuvdd.zm
Size 263KB
SHA256 176cace88088d28479ffc78e289703adee8d4b328cb75882f1c0f499d965dd38
MD5 cd94608224380d1ee070a45d7ac066ed
SHA1 ce356531cf351384bcee1cbba8b4bfe1f161cb7d
SHA512 e3ef7f48c0aa3ddc2e27c6e76d838678a5daed501c130a11a008927c23004fbd06457ee91ca54acbac551f09fb99e1ed215fbed81b561eb0ca91de9d114c0f5a
SSDEEP 6144:MnfS4iUHOQ2uVxcwcMO9nye3k33cJHN1P2zfa5b4:L47OQ1eLMOtyp3AtVb5b4
MD5 SHA1 SHA512 SSDEEP

Submit Download

valglsrdh.exe

Path C:\Users\Admin\AppData\Local\Temp\valglsrdh.exe
Size 137KB
SHA256 3b40db2403bb9ea38d564b013cfd0a6e86438400a5515f30587872dfd1d819d3
MD5 bd6df3e54e26342cb94be8a21e49f935
SHA1 b40f53445a90ec54583ddf07b7774effb928ee55
SHA512 6f409b3dff7b652e7cf9dfea0e65c1d598d71707e6bd6c91379221a9d9f27fe3511b04988f1c3a6ad512b11c21ba1491f872308b384cd056a7c0a156f1cfe43c
SSDEEP 3072:2BiBQROBhUZ+F+XZzlD05wVME57izZxEQvuyM7m0Bnn7mS9z3A8m7:iXRaUoFKZzaCVr7iXuAM3hm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

valglsrdh.exe

Path C:\Users\Admin\AppData\Local\Temp\valglsrdh.exe
Size 137KB
SHA256 3b40db2403bb9ea38d564b013cfd0a6e86438400a5515f30587872dfd1d819d3
MD5 bd6df3e54e26342cb94be8a21e49f935
SHA1 b40f53445a90ec54583ddf07b7774effb928ee55
SHA512 6f409b3dff7b652e7cf9dfea0e65c1d598d71707e6bd6c91379221a9d9f27fe3511b04988f1c3a6ad512b11c21ba1491f872308b384cd056a7c0a156f1cfe43c
SSDEEP 3072:2BiBQROBhUZ+F+XZzlD05wVME57izZxEQvuyM7m0Bnn7mS9z3A8m7:iXRaUoFKZzaCVr7iXuAM3hm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

valglsrdh.exe

Path C:\Users\Admin\AppData\Local\Temp\valglsrdh.exe
Size 137KB
SHA256 3b40db2403bb9ea38d564b013cfd0a6e86438400a5515f30587872dfd1d819d3
MD5 bd6df3e54e26342cb94be8a21e49f935
SHA1 b40f53445a90ec54583ddf07b7774effb928ee55
SHA512 6f409b3dff7b652e7cf9dfea0e65c1d598d71707e6bd6c91379221a9d9f27fe3511b04988f1c3a6ad512b11c21ba1491f872308b384cd056a7c0a156f1cfe43c
SSDEEP 3072:2BiBQROBhUZ+F+XZzlD05wVME57izZxEQvuyM7m0Bnn7mS9z3A8m7:iXRaUoFKZzaCVr7iXuAM3hm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

valglsrdh.exe

Path C:\Users\Admin\AppData\Local\Temp\valglsrdh.exe
Size 137KB
SHA256 3b40db2403bb9ea38d564b013cfd0a6e86438400a5515f30587872dfd1d819d3
MD5 bd6df3e54e26342cb94be8a21e49f935
SHA1 b40f53445a90ec54583ddf07b7774effb928ee55
SHA512 6f409b3dff7b652e7cf9dfea0e65c1d598d71707e6bd6c91379221a9d9f27fe3511b04988f1c3a6ad512b11c21ba1491f872308b384cd056a7c0a156f1cfe43c
SSDEEP 3072:2BiBQROBhUZ+F+XZzlD05wVME57izZxEQvuyM7m0Bnn7mS9z3A8m7:iXRaUoFKZzaCVr7iXuAM3hm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

xwwpxekuvi.zbe

Path C:\Users\Admin\AppData\Local\Temp\xwwpxekuvi.zbe
Size 7KB
SHA256 0416367f850f97448c40603c06de8b4e14affbf2572ef8b9257e57e85f710529
MD5 89e965c0453c845fccd404ac979bcc36
SHA1 96c38af654cdfdbcf685bc842f16f2757fdd905f
SHA512 5df5636957a8e142405a0be0aca7727ed7f3193e670562158ba8bd61bd12e9bb01042c90a5b257446404abc53515746ce6c1803b8ca9303ea13bc6db3782ebe1
SSDEEP 192:darcitQvArWiPvKtb9dA1QxD5ziKw5tLRt9kwL5LF1D7:uCYrNPvKh0k5GTtLRt9ksFx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

valglsrdh.exe

Path \Users\Admin\AppData\Local\Temp\valglsrdh.exe
Size 137KB
SHA256 3b40db2403bb9ea38d564b013cfd0a6e86438400a5515f30587872dfd1d819d3
MD5 bd6df3e54e26342cb94be8a21e49f935
SHA1 b40f53445a90ec54583ddf07b7774effb928ee55
SHA512 6f409b3dff7b652e7cf9dfea0e65c1d598d71707e6bd6c91379221a9d9f27fe3511b04988f1c3a6ad512b11c21ba1491f872308b384cd056a7c0a156f1cfe43c
SSDEEP 3072:2BiBQROBhUZ+F+XZzlD05wVME57izZxEQvuyM7m0Bnn7mS9z3A8m7:iXRaUoFKZzaCVr7iXuAM3hm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

valglsrdh.exe

Path \Users\Admin\AppData\Local\Temp\valglsrdh.exe
Size 137KB
SHA256 3b40db2403bb9ea38d564b013cfd0a6e86438400a5515f30587872dfd1d819d3
MD5 bd6df3e54e26342cb94be8a21e49f935
SHA1 b40f53445a90ec54583ddf07b7774effb928ee55
SHA512 6f409b3dff7b652e7cf9dfea0e65c1d598d71707e6bd6c91379221a9d9f27fe3511b04988f1c3a6ad512b11c21ba1491f872308b384cd056a7c0a156f1cfe43c
SSDEEP 3072:2BiBQROBhUZ+F+XZzlD05wVME57izZxEQvuyM7m0Bnn7mS9z3A8m7:iXRaUoFKZzaCVr7iXuAM3hm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

valglsrdh.exe

Path \Users\Admin\AppData\Local\Temp\valglsrdh.exe
Size 137KB
SHA256 3b40db2403bb9ea38d564b013cfd0a6e86438400a5515f30587872dfd1d819d3
MD5 bd6df3e54e26342cb94be8a21e49f935
SHA1 b40f53445a90ec54583ddf07b7774effb928ee55
SHA512 6f409b3dff7b652e7cf9dfea0e65c1d598d71707e6bd6c91379221a9d9f27fe3511b04988f1c3a6ad512b11c21ba1491f872308b384cd056a7c0a156f1cfe43c
SSDEEP 3072:2BiBQROBhUZ+F+XZzlD05wVME57izZxEQvuyM7m0Bnn7mS9z3A8m7:iXRaUoFKZzaCVr7iXuAM3hm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/320-70-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/320-73-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/320-75-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/320-76-0x00000000001D0000-0x0000000000200000-memory.dmp

Download

memory/320-77-0x00000000049B0000-0x00000000049F0000-memory.dmp

Download

memory/320-78-0x00000000049B0000-0x00000000049F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads