agenttesla | 6145c8fc813d508340218c8738c6002d2a8e5e6d4b0795c52acfdd2f48e09228

Analysis

max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2023, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TNT EXPRESS CONSIGNMENT.exe
Size 323KB
Sample230309-kggcaaad21
SHA256 6145c8fc813d508340218c8738c6002d2a8e5e6d4b0795c52acfdd2f48e09228
MD5 ba950a05b7440eda80ab5de407bd54f5
SHA1 b0242113dc571a03dc63f79581296c1e944612e4
SHA512 6ab1236badf37ebbc7b6df9f72efd6c8354c2d7e63d81b2df1c02f39520e918ba69f41ed2815e4a33b1c642778c7226f84cc1e9ee3cf733957f344fad15b4dc6
SSDEEP 6144:TYa635IM0RdEqpQScQMTn33m/CHPUQInfvfXnIbx0QU31BRW0WmpjAx/8:TYl5IM07TcQ8ECMPyDe1+3mpj48
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 4 IoCs

resource	yara_rule
behavioral2/memory/804-142-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/804-144-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/804-145-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/804-147-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

pid	Process
3024	oalnoej.exe
804	oalnoej.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oalnoej.exe
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oalnoej.exe
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oalnoej.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 804	3024	oalnoej.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
804	oalnoej.exe
804	oalnoej.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3024	oalnoej.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	oalnoej.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3024	4704	TNT EXPRESS CONSIGNMENT.exe	82
PID 4704 wrote to memory of 3024	4704	TNT EXPRESS CONSIGNMENT.exe	82
PID 4704 wrote to memory of 3024	4704	TNT EXPRESS CONSIGNMENT.exe	82
PID 3024 wrote to memory of 804	3024	oalnoej.exe	83
PID 3024 wrote to memory of 804	3024	oalnoej.exe	83
PID 3024 wrote to memory of 804	3024	oalnoej.exe	83
PID 3024 wrote to memory of 804	3024	oalnoej.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oalnoej.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oalnoej.exe

C:\Users\Admin\AppData\Local\Temp\TNT EXPRESS CONSIGNMENT.exe
"C:\Users\Admin\AppData\Local\Temp\TNT EXPRESS CONSIGNMENT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
  "C:\Users\Admin\AppData\Local\Temp\oalnoej.exe" C:\Users\Admin\AppData\Local\Temp\vbypskzzm.t
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
    "C:\Users\Admin\AppData\Local\Temp\oalnoej.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oalnoej.exe

Path C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oalnoej.exe

Path C:\Users\Admin\AppData\Local\Temp\oalnoej.exe
Size 59KB
SHA256 3b1a79dda0951581ed272d5ea7ff58f597c5d3f407a69e60f74b413b823104da
MD5 78e44cbf4ec70a365294ce34ed460993
SHA1 82f2202f2479affa4a20be3490ec06619f25b50c
SHA512 3f2dfb826b436282341b4e84e1d3801941b7b54672ae328fc59606a546a27b39b74da9bbb35154e8e5a267c881b831213d895c46f2fe2ebe3d221f663f5f27c7
SSDEEP 768:yRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9zBDm:ytu3whIc/6c5Mtq9zB
MD5 SHA1 SHA512 SSDEEP

Submit Download

uluuzv.qwq

Path C:\Users\Admin\AppData\Local\Temp\uluuzv.qwq
Size 314KB
SHA256 13aa92dd7fe066f07b60550741a82dfd477843d3126db8e9b1bb701adcb0391f
MD5 45fc83dc1926d584f12f2967b68c21c3
SHA1 7d5532026f4512ebd5483b65603e1692b6494b79
SHA512 67c3f48d3d56bf898ff1458ed9a699d6ca60da3c48a47629f1c7f3faf159b35c15c030e845d458b0c2c4136bbde8564cd81ce4a727a031151e0d3c9b38339381
SSDEEP 6144:p6HzQnQPYrK9wZZ8ysvN9ueQ6R3TcHvt2Cn7jdCGb7LzapAhCjP6RNrG:cTlYWqfkQOSACnfdCGnjCz2NG
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbypskzzm.t

Path C:\Users\Admin\AppData\Local\Temp\vbypskzzm.t
Size 5KB
SHA256 f0568d9a0b3e55447aa7f4e7d542ce3f991d7f68c16040056949856f2a75ee2f
MD5 1cb41ebf743002419c569cca4bde38bb
SHA1 e9c159bb3ed610c5add654c10a13690d8adb6201
SHA512 dab616e888aa3859ff1dcadcaedba7882d97338768d31e1b9f84101854fa1e849137010137343879a7ec4463e7088ef40d1f33a6cb4b4946262fd3cd07bc93e8
SSDEEP 96:Farc6oY0g/DrYupk2XO5oSwYZn1V9xfL8uYxJU15FK9OHPfrHCmbvrfjXC:FarcREhhX1S9XrVLtuJU15PJLrLXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/804-149-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-151-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-145-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/804-147-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/804-148-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-142-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/804-150-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-144-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/804-152-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-153-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-154-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-155-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-156-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-157-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-158-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/804-159-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download