agenttesla | 336c6e2174453e52f6c8f72ff0b886011c5ab0d497b357de19b393d7c22214e8

General

Target

Payment Swift USD18,000.exe
Size

841KB
MD5

cb4f52bfbd20524cd1e593e3d144b437
SHA1

b0a969cc5823930321ee787ef1308352e40d2131
SHA256

336c6e2174453e52f6c8f72ff0b886011c5ab0d497b357de19b393d7c22214e8
SHA512

c3d3197c1be34dff339c5d836ba8eead12074cb71913734235437767e62f9eec3fec389360aa7db11e59fe702be9c69b261bc5705d307468c36a3831247099c7
SSDEEP

12288:rzC++IpjkjXyuaqZM+3pUH4mrVs239gWwvhDWs3tdc9jyT4p00gAEy5aB+AEZzis:gwjkj+UMsUH4m+1vJWSdcgTqSPFMBxV

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.focuzpartsmart.com
Port:
587
Username:
[email protected]
Password:
FpmJhn@2023
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Swift USD18,000.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Swift USD18,000.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Swift USD18,000.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 828	1712	Payment Swift USD18,000.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1712	Payment Swift USD18,000.exe
1712	Payment Swift USD18,000.exe
1712	Payment Swift USD18,000.exe
1920	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	Payment Swift USD18,000.exe
Token: SeDebugPrivilege	828	Payment Swift USD18,000.exe
Token: SeDebugPrivilege	1920	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1920	1712	Payment Swift USD18,000.exe	28
PID 1712 wrote to memory of 1920	1712	Payment Swift USD18,000.exe	28
PID 1712 wrote to memory of 1920	1712	Payment Swift USD18,000.exe	28
PID 1712 wrote to memory of 1920	1712	Payment Swift USD18,000.exe	28
PID 1712 wrote to memory of 580	1712	Payment Swift USD18,000.exe	30
PID 1712 wrote to memory of 580	1712	Payment Swift USD18,000.exe	30
PID 1712 wrote to memory of 580	1712	Payment Swift USD18,000.exe	30
PID 1712 wrote to memory of 580	1712	Payment Swift USD18,000.exe	30
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32
PID 1712 wrote to memory of 828	1712	Payment Swift USD18,000.exe	32

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Swift USD18,000.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Swift USD18,000.exe

C:\Users\Admin\AppData\Local\Temp\Payment Swift USD18,000.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Swift USD18,000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YJPxDLdaAvgR.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YJPxDLdaAvgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBB93.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:580
- C:\Users\Admin\AppData\Local\Temp\Payment Swift USD18,000.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Swift USD18,000.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBB93.tmp

Filesize
1KB

MD5
f58beeb185bdaa740159ea66d63f7b14

SHA1
ad21b7f078a48a4cb6bcf81e8a45821d8f851664

SHA256
c93877d6184dc8e1c4d64348075a676446eadbb05645a3d4175dbf8bad84a017

SHA512
9278cf24c29c5a95edf7861011f236a0bdac538849ea7c65821933445b5ddd256f4464f6aeb36cc123905e63fbae06a97df189749015823e28b4642bbfb11425

Download Submit
memory/828-76-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/828-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/828-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/828-70-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/828-79-0x00000000043D0000-0x0000000004410000-memory.dmp

Filesize
256KB

Download
memory/828-78-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/828-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/828-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/828-72-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/828-81-0x00000000043D0000-0x0000000004410000-memory.dmp

Filesize
256KB

Download
memory/1712-57-0x0000000000600000-0x0000000000640000-memory.dmp

Filesize
256KB

Download
memory/1712-68-0x0000000004A20000-0x0000000004A52000-memory.dmp

Filesize
200KB

Download
memory/1712-67-0x0000000004940000-0x0000000004946000-memory.dmp

Filesize
24KB

Download
memory/1712-56-0x0000000000370000-0x000000000038A000-memory.dmp

Filesize
104KB

Download
memory/1712-54-0x0000000000C80000-0x0000000000D58000-memory.dmp

Filesize
864KB

Download
memory/1712-55-0x0000000000600000-0x0000000000640000-memory.dmp

Filesize
256KB

Download
memory/1712-59-0x0000000007DA0000-0x0000000007E4A000-memory.dmp

Filesize
680KB

Download
memory/1712-58-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/1920-80-0x0000000002620000-0x0000000002660000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads