agenttesla | 5b0cb936865587b7d9fa14900e6ba7710d145872b77ac57570b3521c10191cda

General

Target

Kopia platnosci Bank Pekao-6100046554300060012.exe
Size

501KB
MD5

26a08f0f611ff71679873104dbea4d39
SHA1

a76c3a9ac264878f0d715e81820b5edaa3c621a3
SHA256

5b0cb936865587b7d9fa14900e6ba7710d145872b77ac57570b3521c10191cda
SHA512

51bf94b0d41216f02fe776c939561eee028de0bdfa33f2777947ff386e62f8f09363f83efae786124a8539b8b1e9fe2893a37f4d32f2994f5b5602f6f97528f0
SSDEEP

6144:mclAYP4QmP2qYmWCYyB9QSn8qq13w3CpjGDiSzdrnFvsHLZBqJ1Si82EOQis:b3S63u1nFvsHLZi1SiREX

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.1und1.de
Port:
587
Username:
[email protected]
Password:
xwwwbm1919
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Kopia platnosci Bank Pekao-6100046554300060012.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Kopia platnosci Bank Pekao-6100046554300060012.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Kopia platnosci Bank Pekao-6100046554300060012.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1008 set thread context of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4064	powershell.exe
4064	powershell.exe
4064	powershell.exe
1008	Kopia platnosci Bank Pekao-6100046554300060012.exe
1008	Kopia platnosci Bank Pekao-6100046554300060012.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4016	Kopia platnosci Bank Pekao-6100046554300060012.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 4064	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	66
PID 1008 wrote to memory of 4064	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	66
PID 1008 wrote to memory of 4064	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	66
PID 1008 wrote to memory of 2592	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	68
PID 1008 wrote to memory of 2592	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	68
PID 1008 wrote to memory of 2592	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	68
PID 1008 wrote to memory of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69
PID 1008 wrote to memory of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69
PID 1008 wrote to memory of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69
PID 1008 wrote to memory of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69
PID 1008 wrote to memory of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69
PID 1008 wrote to memory of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69
PID 1008 wrote to memory of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69
PID 1008 wrote to memory of 4016	1008	Kopia platnosci Bank Pekao-6100046554300060012.exe	69

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Kopia platnosci Bank Pekao-6100046554300060012.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Kopia platnosci Bank Pekao-6100046554300060012.exe

C:\Users\Admin\AppData\Local\Temp\Kopia platnosci Bank Pekao-6100046554300060012.exe
"C:\Users\Admin\AppData\Local\Temp\Kopia platnosci Bank Pekao-6100046554300060012.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\Kopia platnosci Bank Pekao-6100046554300060012.exe
  "C:\Users\Admin\AppData\Local\Temp\Kopia platnosci Bank Pekao-6100046554300060012.exe"
  2⤵
  PID:2592
- C:\Users\Admin\AppData\Local\Temp\Kopia platnosci Bank Pekao-6100046554300060012.exe
  "C:\Users\Admin\AppData\Local\Temp\Kopia platnosci Bank Pekao-6100046554300060012.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Kopia platnosci Bank Pekao-6100046554300060012.exe.log

Filesize
1KB

MD5
658b2f3422fc885820bba6ca90e08f7c

SHA1
bef4a36d52375e6f289e6abd2a3927e88aa4d1d6

SHA256
d05a71cf44ab8d2eb20b35972a827b2ef7370b3d2042372f7b0108b7299cf384

SHA512
aaf4e98e6c93e3572e561d97b43c00d4a6ec96f512cf78304af160d5989cc4c3b38482a9df848b5e485b7c7f7ececf8c9ad554a2b2a4e3ee6b43fa66755494af

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_arj0rw04.rdq.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/1008-118-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/1008-119-0x0000000005BC0000-0x0000000005D12000-memory.dmp

Filesize
1.3MB

Download
memory/1008-120-0x0000000005DD0000-0x0000000005E62000-memory.dmp

Filesize
584KB

Download
memory/1008-121-0x0000000005280000-0x00000000052A2000-memory.dmp

Filesize
136KB

Download
memory/1008-122-0x0000000005E60000-0x00000000061B0000-memory.dmp

Filesize
3.3MB

Download
memory/1008-117-0x00000000000E0000-0x0000000000164000-memory.dmp

Filesize
528KB

Download
memory/1008-150-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/4016-164-0x0000000006300000-0x0000000006350000-memory.dmp

Filesize
320KB

Download
memory/4016-162-0x0000000006120000-0x00000000061B2000-memory.dmp

Filesize
584KB

Download
memory/4016-161-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/4016-160-0x00000000057A0000-0x0000000005C9E000-memory.dmp

Filesize
5.0MB

Download
memory/4016-163-0x00000000060E0000-0x00000000060EA000-memory.dmp

Filesize
40KB

Download
memory/4016-157-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4016-171-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/4064-126-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4064-149-0x0000000009740000-0x000000000975A000-memory.dmp

Filesize
104KB

Download
memory/4064-148-0x000000000A1A0000-0x000000000A818000-memory.dmp

Filesize
6.5MB

Download
memory/4064-151-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4064-152-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4064-133-0x0000000008890000-0x0000000008906000-memory.dmp

Filesize
472KB

Download
memory/4064-132-0x0000000008B40000-0x0000000008B8B000-memory.dmp

Filesize
300KB

Download
memory/4064-131-0x0000000007980000-0x000000000799C000-memory.dmp

Filesize
112KB

Download
memory/4064-130-0x00000000081B0000-0x0000000008216000-memory.dmp

Filesize
408KB

Download
memory/4064-129-0x0000000008140000-0x00000000081A6000-memory.dmp

Filesize
408KB

Download
memory/4064-128-0x00000000079A0000-0x0000000007FC8000-memory.dmp

Filesize
6.2MB

Download
memory/4064-127-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4064-125-0x0000000004E00000-0x0000000004E36000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing