agenttesla | b4a5e199a29723b27c6aced8f28c7b39f29738bfb2ea3ada079e38c4aad366f4

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/03/2023, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tender QUOTATION_ LH22000309AA2023.exe
Size 309KB
Sample230320-lyck4ach23
SHA256 b4a5e199a29723b27c6aced8f28c7b39f29738bfb2ea3ada079e38c4aad366f4
MD5 e615251b80317473a68488a21a1d0457
SHA1 56f3a2dcf6d730126426ce2d65ae5819ca4c753e
SHA512 5cc554d11ed4f89b8993ad04276929978ec1c4840cf5a5e1e013b77eb3a87138e17e550815bae461085caa7ab81b916c7f24c12f3bdfa796b1e06fd8cf21aab9
SSDEEP 6144:/Ya6WT4gMl7QMZVzkNrIXjsh+IHqneS8p1ARssPdP5lkNxbZ:/YQsgorXsHqneJVdpZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
924	rtvzitvzef.exe
1496	rtvzitvzef.exe

Loads dropped DLL 3 IoCs

pid	Process
1320	Tender QUOTATION_ LH22000309AA2023.exe
1320	Tender QUOTATION_ LH22000309AA2023.exe
924	rtvzitvzef.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rtvzitvzef.exe
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rtvzitvzef.exe
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rtvzitvzef.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 924 set thread context of 1496	924	rtvzitvzef.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
924	rtvzitvzef.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	rtvzitvzef.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 924	1320	Tender QUOTATION_ LH22000309AA2023.exe	28
PID 1320 wrote to memory of 924	1320	Tender QUOTATION_ LH22000309AA2023.exe	28
PID 1320 wrote to memory of 924	1320	Tender QUOTATION_ LH22000309AA2023.exe	28
PID 1320 wrote to memory of 924	1320	Tender QUOTATION_ LH22000309AA2023.exe	28
PID 924 wrote to memory of 1496	924	rtvzitvzef.exe	30
PID 924 wrote to memory of 1496	924	rtvzitvzef.exe	30
PID 924 wrote to memory of 1496	924	rtvzitvzef.exe	30
PID 924 wrote to memory of 1496	924	rtvzitvzef.exe	30
PID 924 wrote to memory of 1496	924	rtvzitvzef.exe	30

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rtvzitvzef.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rtvzitvzef.exe

C:\Users\Admin\AppData\Local\Temp\Tender QUOTATION_ LH22000309AA2023.exe
"C:\Users\Admin\AppData\Local\Temp\Tender QUOTATION_ LH22000309AA2023.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
  "C:\Users\Admin\AppData\Local\Temp\rtvzitvzef.exe" C:\Users\Admin\AppData\Local\Temp\ggbdhaflcbm.cer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
    "C:\Users\Admin\AppData\Local\Temp\rtvzitvzef.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

buvzkr.sej

Path C:\Users\Admin\AppData\Local\Temp\buvzkr.sej
Size 262KB
SHA256 72a97e584b67fe97623c6b121149ae588ba1daaf74650ef0ae24803b4cfbadf6
MD5 07bdc7754fd2d24abecf19bea0d8edba
SHA1 571fe777a979ffcec0da4b23218728b747353054
SHA512 34df6bc7c58ebade6d16510548fb1916beb3a27348aeb659af4423df23971d7ef1ff3e6bf0e27a9f915e2c471fc595379e4bd349ce0a69007b3922f72b089454
SSDEEP 6144:7/ENh2fSlLKY2EFQTQ19y8Iryj6JOhIX4CPVuaj5j2xP2jVP9l6HSZz:7sN0KsYRp9nITcCpVTj5SxA9AHSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ggbdhaflcbm.cer

Path C:\Users\Admin\AppData\Local\Temp\ggbdhaflcbm.cer
Size 5KB
SHA256 6b2ab38f6b3f0f3254b9c9e288814c6d61ca2848a827d8f4fa815a422ceafe9d
MD5 0b8a956cd495cc12be4d2bb8bcb56a64
SHA1 b80fe7cbdb389fb044c63bdeb124f866945e24ac
SHA512 e09c8200eede41aa352c531eb7300a2682611feb53922ef97e30c275cacbd41658f21fbe919b5b1460bd828e81a383b6d9f07e8a8c6f15b12346056e7b6d23e2
SSDEEP 96:Farc6oYCg/DrYugk2XO5oSwYM1VmnjMoCMdSNyJ5c8/miYyGCZS7zmzuZPVed:FarcRiohX1S9SEATcSwJ5c8/m1sVzSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtvzitvzef.exe

Path C:\Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
Size 93KB
SHA256 bcaee4aed66e705bd14ed4994b7376fe06830bf2ce864fbcc307bbbf9613a7fa
MD5 18995c06b5ce38c0d46a65451b5aafb0
SHA1 bcd38033c62bd2d7200201c785c2e5a7aedda81a
SHA512 fb8c76b256ef7e98ba6c96c2e6d0c167e5b292a004ffdfd70b361e8d4ef9e4fe223f3f81a54e0473f248418c13f0e7f5696e53d446c6c74d8690bbdf1afd5b26
SSDEEP 1536:w0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvCk:pd4KALsGZDN+x/yuZocSTkyBw9y8eASL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtvzitvzef.exe

Path C:\Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
Size 93KB
SHA256 bcaee4aed66e705bd14ed4994b7376fe06830bf2ce864fbcc307bbbf9613a7fa
MD5 18995c06b5ce38c0d46a65451b5aafb0
SHA1 bcd38033c62bd2d7200201c785c2e5a7aedda81a
SHA512 fb8c76b256ef7e98ba6c96c2e6d0c167e5b292a004ffdfd70b361e8d4ef9e4fe223f3f81a54e0473f248418c13f0e7f5696e53d446c6c74d8690bbdf1afd5b26
SSDEEP 1536:w0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvCk:pd4KALsGZDN+x/yuZocSTkyBw9y8eASL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtvzitvzef.exe

Path C:\Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
Size 93KB
SHA256 bcaee4aed66e705bd14ed4994b7376fe06830bf2ce864fbcc307bbbf9613a7fa
MD5 18995c06b5ce38c0d46a65451b5aafb0
SHA1 bcd38033c62bd2d7200201c785c2e5a7aedda81a
SHA512 fb8c76b256ef7e98ba6c96c2e6d0c167e5b292a004ffdfd70b361e8d4ef9e4fe223f3f81a54e0473f248418c13f0e7f5696e53d446c6c74d8690bbdf1afd5b26
SSDEEP 1536:w0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvCk:pd4KALsGZDN+x/yuZocSTkyBw9y8eASL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtvzitvzef.exe

Path C:\Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
Size 93KB
SHA256 bcaee4aed66e705bd14ed4994b7376fe06830bf2ce864fbcc307bbbf9613a7fa
MD5 18995c06b5ce38c0d46a65451b5aafb0
SHA1 bcd38033c62bd2d7200201c785c2e5a7aedda81a
SHA512 fb8c76b256ef7e98ba6c96c2e6d0c167e5b292a004ffdfd70b361e8d4ef9e4fe223f3f81a54e0473f248418c13f0e7f5696e53d446c6c74d8690bbdf1afd5b26
SSDEEP 1536:w0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvCk:pd4KALsGZDN+x/yuZocSTkyBw9y8eASL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtvzitvzef.exe

Path \Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
Size 93KB
SHA256 bcaee4aed66e705bd14ed4994b7376fe06830bf2ce864fbcc307bbbf9613a7fa
MD5 18995c06b5ce38c0d46a65451b5aafb0
SHA1 bcd38033c62bd2d7200201c785c2e5a7aedda81a
SHA512 fb8c76b256ef7e98ba6c96c2e6d0c167e5b292a004ffdfd70b361e8d4ef9e4fe223f3f81a54e0473f248418c13f0e7f5696e53d446c6c74d8690bbdf1afd5b26
SSDEEP 1536:w0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvCk:pd4KALsGZDN+x/yuZocSTkyBw9y8eASL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtvzitvzef.exe

Path \Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
Size 93KB
SHA256 bcaee4aed66e705bd14ed4994b7376fe06830bf2ce864fbcc307bbbf9613a7fa
MD5 18995c06b5ce38c0d46a65451b5aafb0
SHA1 bcd38033c62bd2d7200201c785c2e5a7aedda81a
SHA512 fb8c76b256ef7e98ba6c96c2e6d0c167e5b292a004ffdfd70b361e8d4ef9e4fe223f3f81a54e0473f248418c13f0e7f5696e53d446c6c74d8690bbdf1afd5b26
SSDEEP 1536:w0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvCk:pd4KALsGZDN+x/yuZocSTkyBw9y8eASL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtvzitvzef.exe

Path \Users\Admin\AppData\Local\Temp\rtvzitvzef.exe
Size 93KB
SHA256 bcaee4aed66e705bd14ed4994b7376fe06830bf2ce864fbcc307bbbf9613a7fa
MD5 18995c06b5ce38c0d46a65451b5aafb0
SHA1 bcd38033c62bd2d7200201c785c2e5a7aedda81a
SHA512 fb8c76b256ef7e98ba6c96c2e6d0c167e5b292a004ffdfd70b361e8d4ef9e4fe223f3f81a54e0473f248418c13f0e7f5696e53d446c6c74d8690bbdf1afd5b26
SSDEEP 1536:w0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvCk:pd4KALsGZDN+x/yuZocSTkyBw9y8eASL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1496-68-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1496-72-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1496-73-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1496-74-0x00000000003D0000-0x0000000000400000-memory.dmp

Download

memory/1496-75-0x00000000045B0000-0x00000000045F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads