agenttesla | 325216a364f592e7152bacd50dda7b084120186c71ad5a4c3af8d2583b752cde

General

Target

4bbd82474dc1c45d8db7eb45ead0722aed3a8f2c3f989b4151e62e64af1c3c3c.exe
Size

320KB
MD5

c50d0e6336b2a71bebcf898513c337a7
SHA1

209a96f4252de81b40ada8137373f96e51acd897
SHA256

4bbd82474dc1c45d8db7eb45ead0722aed3a8f2c3f989b4151e62e64af1c3c3c
SHA512

c13d1582f7773191a1ce599da7ca453f2ef7d4cb651edbbd9bb69b102165b91bbabf92cb57e01fbbca33a8a25e821d80938e3debdff29b526781b587dd2628b2
SSDEEP

6144:vYa6CRBAqdiNnbGL0cIizDZEzAapf3iNQUoNEr6Z2HW9HcWZR:vYkRyrnbe0czvWzAi3iaN1f8OR

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 4 IoCs

resource	yara_rule
behavioral2/memory/548-142-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/548-144-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/548-146-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/548-147-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

pid	Process
3768	dvqwjgk.exe
548	dvqwjgk.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dvqwjgk.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dvqwjgk.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dvqwjgk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3768 set thread context of 548	3768	dvqwjgk.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
548	dvqwjgk.exe
548	dvqwjgk.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3768	dvqwjgk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	dvqwjgk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 3768	380	4bbd82474dc1c45d8db7eb45ead0722aed3a8f2c3f989b4151e62e64af1c3c3c.exe	85
PID 380 wrote to memory of 3768	380	4bbd82474dc1c45d8db7eb45ead0722aed3a8f2c3f989b4151e62e64af1c3c3c.exe	85
PID 380 wrote to memory of 3768	380	4bbd82474dc1c45d8db7eb45ead0722aed3a8f2c3f989b4151e62e64af1c3c3c.exe	85
PID 3768 wrote to memory of 548	3768	dvqwjgk.exe	86
PID 3768 wrote to memory of 548	3768	dvqwjgk.exe	86
PID 3768 wrote to memory of 548	3768	dvqwjgk.exe	86
PID 3768 wrote to memory of 548	3768	dvqwjgk.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dvqwjgk.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dvqwjgk.exe

C:\Users\Admin\AppData\Local\Temp\4bbd82474dc1c45d8db7eb45ead0722aed3a8f2c3f989b4151e62e64af1c3c3c.exe
"C:\Users\Admin\AppData\Local\Temp\4bbd82474dc1c45d8db7eb45ead0722aed3a8f2c3f989b4151e62e64af1c3c3c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\dvqwjgk.exe
  "C:\Users\Admin\AppData\Local\Temp\dvqwjgk.exe" C:\Users\Admin\AppData\Local\Temp\vclabid.jr
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Users\Admin\AppData\Local\Temp\dvqwjgk.exe
    "C:\Users\Admin\AppData\Local\Temp\dvqwjgk.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dvqwjgk.exe

Filesize
53KB

MD5
f0b303f0c99dddfef157a249cd995402

SHA1
a25ffaeafba7d7a05700cf758c53bb8e22cb1807

SHA256
e27f2341bf0ce00613f2eba5325f3385fd2687a06c81533287191a8f82538fcc

SHA512
c7bc3f629e5d99d23f90ca91d91d5c97a9ad71859ad7099ce5f4948d99deb535e5502da9dc3124cc0e42323c2f9f317ad6f27ca74e700c2ac593e12dd34ce4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\dvqwjgk.exe

Filesize
53KB

MD5
f0b303f0c99dddfef157a249cd995402

SHA1
a25ffaeafba7d7a05700cf758c53bb8e22cb1807

SHA256
e27f2341bf0ce00613f2eba5325f3385fd2687a06c81533287191a8f82538fcc

SHA512
c7bc3f629e5d99d23f90ca91d91d5c97a9ad71859ad7099ce5f4948d99deb535e5502da9dc3124cc0e42323c2f9f317ad6f27ca74e700c2ac593e12dd34ce4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\dvqwjgk.exe

Filesize
53KB

MD5
f0b303f0c99dddfef157a249cd995402

SHA1
a25ffaeafba7d7a05700cf758c53bb8e22cb1807

SHA256
e27f2341bf0ce00613f2eba5325f3385fd2687a06c81533287191a8f82538fcc

SHA512
c7bc3f629e5d99d23f90ca91d91d5c97a9ad71859ad7099ce5f4948d99deb535e5502da9dc3124cc0e42323c2f9f317ad6f27ca74e700c2ac593e12dd34ce4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\svkzotimyc.xbt

Filesize
314KB

MD5
21155fd7bc83a871bca64e88240bb56d

SHA1
30a25c370289d88be23b18a0c923fef1affac3a6

SHA256
c12bea3eedbee6372bbce59d77cac83eed4b73e4fbc226c76eddbdc9c960e624

SHA512
6f0c1baf8572be8206ed9d8d3d5fdef8730291551101a35bacf50ca9ad31271bfd1ea8d9b7c5bde8508e150eb8c14adfb57c876afb50afb3f79115bb208f44ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\vclabid.jr

Filesize
5KB

MD5
78f090f09575e547327e1808ffe67ce9

SHA1
6bee03daf2d617e4bc1a4aa994e4cf65ce41975d

SHA256
14b0105745596469c85e789c350b172e401342ff21079d155ab38e804a736a8e

SHA512
a76d139ce3ce984e0f2249570cedc0a7173e4080563e8d99f9b1d01150c4c2400546bd17cea145776f85a0312bc473efd5b7c2a754802c8b301c78a59b9b2022

Download Submit
memory/548-149-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-151-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-146-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/548-147-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/548-148-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-142-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/548-150-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-144-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/548-152-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-153-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-154-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-155-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-156-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-157-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-158-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/548-159-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing