agenttesla | 44daf0f79a8c0f762378b5418a90d3b15925d4be8f35be293bc2ef657aee7078

Analysis

max time kernel
142s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/03/2023, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a02d50415b4f76d02cda80340ecccbe.exe
Size 266KB
Sample230322-fa4rsagh21
SHA256 44daf0f79a8c0f762378b5418a90d3b15925d4be8f35be293bc2ef657aee7078
MD5 3a02d50415b4f76d02cda80340ecccbe
SHA1 5f4ecc1fe8f99ebafcba4d15df74c535a8c5c800
SHA512 705ea07c38fee76b1fe29f6f975907b9491e226e30703345ab2217a679292b1e27c68f1b037c0108b51ae5dcdf3472d5b23f710a61d5a0f534681ef58c81156c
SSDEEP 6144:/Ya6AtECrPFGPiBztYwpoEVoa01VPIDSEYqGCX:/YOtzVR8ESJ1jkX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
1420	hjnmul.exe
464	hjnmul.exe

Loads dropped DLL 3 IoCs

pid	Process
932	3a02d50415b4f76d02cda80340ecccbe.exe
932	3a02d50415b4f76d02cda80340ecccbe.exe
1420	hjnmul.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hjnmul.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hjnmul.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hjnmul.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\VllURjY = "C:\\Users\\Admin\\AppData\\Roaming\\VllURjY\\VllURjY.exe"	hjnmul.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 464	1420	hjnmul.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1420	hjnmul.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	hjnmul.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1420	932	3a02d50415b4f76d02cda80340ecccbe.exe	28
PID 932 wrote to memory of 1420	932	3a02d50415b4f76d02cda80340ecccbe.exe	28
PID 932 wrote to memory of 1420	932	3a02d50415b4f76d02cda80340ecccbe.exe	28
PID 932 wrote to memory of 1420	932	3a02d50415b4f76d02cda80340ecccbe.exe	28
PID 1420 wrote to memory of 464	1420	hjnmul.exe	30
PID 1420 wrote to memory of 464	1420	hjnmul.exe	30
PID 1420 wrote to memory of 464	1420	hjnmul.exe	30
PID 1420 wrote to memory of 464	1420	hjnmul.exe	30
PID 1420 wrote to memory of 464	1420	hjnmul.exe	30

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hjnmul.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hjnmul.exe

C:\Users\Admin\AppData\Local\Temp\3a02d50415b4f76d02cda80340ecccbe.exe
"C:\Users\Admin\AppData\Local\Temp\3a02d50415b4f76d02cda80340ecccbe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\hjnmul.exe
  "C:\Users\Admin\AppData\Local\Temp\hjnmul.exe" C:\Users\Admin\AppData\Local\Temp\aeivwyul.y
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Users\Admin\AppData\Local\Temp\hjnmul.exe
    "C:\Users\Admin\AppData\Local\Temp\hjnmul.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aeivwyul.y

Path C:\Users\Admin\AppData\Local\Temp\aeivwyul.y
Size 5KB
SHA256 648165b38e28dceaf321aa424636e61a3d0fd0abf6c214a8e6bfd1f6c2b58df2
MD5 457ad24b5c2643b5f33e2907b82cdf6a
SHA1 b4cb07508e843789891b2e1f1d6061789c46d22c
SHA512 b2ee778b5d62819748900ca875165e212e859c9c91f1edb720961f167c91331a0cd0b9e3aa4c51e1ef4d9b486e97cf8fd822f841639c9b096e4adda9d9455f55
SSDEEP 96:Farc6oYM0g/DrYudsTk2XO5oSw0PdrqZTc9Df+ADDshqwUfgNbQXzL2gf:FarcRFjlsThX1SJlr3zpDkus5gf
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjnmul.exe

Path C:\Users\Admin\AppData\Local\Temp\hjnmul.exe
Size 4KB
SHA256 505968cc347bc2950b3bf892560f23c9c7c4ea9dfad398505b118f477f275e37
MD5 54decb55baf865b63e577ee2dfdb5f40
SHA1 543870daede33b94934c4e3cbf1df71684f83399
SHA512 f5d86e4151af6b2e7c266368cf28d57265e71b56db337bfa7af3f1720282fd710bb87d6690c5e029a37760fa8ec5cfc08203e21ce96a7e80a8beb63d83f0a794
SSDEEP 48:CKJ13yPZnF3OANzjszbdbPhOhBFTSBjsb5P4oyl19yVg8/VdzsUTlJzZ:LiPZFP1jwOSBjy5P4oyn9Wn9JxpJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjnmul.exe

Path C:\Users\Admin\AppData\Local\Temp\hjnmul.exe
Size 4KB
SHA256 505968cc347bc2950b3bf892560f23c9c7c4ea9dfad398505b118f477f275e37
MD5 54decb55baf865b63e577ee2dfdb5f40
SHA1 543870daede33b94934c4e3cbf1df71684f83399
SHA512 f5d86e4151af6b2e7c266368cf28d57265e71b56db337bfa7af3f1720282fd710bb87d6690c5e029a37760fa8ec5cfc08203e21ce96a7e80a8beb63d83f0a794
SSDEEP 48:CKJ13yPZnF3OANzjszbdbPhOhBFTSBjsb5P4oyl19yVg8/VdzsUTlJzZ:LiPZFP1jwOSBjy5P4oyn9Wn9JxpJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjnmul.exe

Path C:\Users\Admin\AppData\Local\Temp\hjnmul.exe
Size 4KB
SHA256 505968cc347bc2950b3bf892560f23c9c7c4ea9dfad398505b118f477f275e37
MD5 54decb55baf865b63e577ee2dfdb5f40
SHA1 543870daede33b94934c4e3cbf1df71684f83399
SHA512 f5d86e4151af6b2e7c266368cf28d57265e71b56db337bfa7af3f1720282fd710bb87d6690c5e029a37760fa8ec5cfc08203e21ce96a7e80a8beb63d83f0a794
SSDEEP 48:CKJ13yPZnF3OANzjszbdbPhOhBFTSBjsb5P4oyl19yVg8/VdzsUTlJzZ:LiPZFP1jwOSBjy5P4oyn9Wn9JxpJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjnmul.exe

Path C:\Users\Admin\AppData\Local\Temp\hjnmul.exe
Size 4KB
SHA256 505968cc347bc2950b3bf892560f23c9c7c4ea9dfad398505b118f477f275e37
MD5 54decb55baf865b63e577ee2dfdb5f40
SHA1 543870daede33b94934c4e3cbf1df71684f83399
SHA512 f5d86e4151af6b2e7c266368cf28d57265e71b56db337bfa7af3f1720282fd710bb87d6690c5e029a37760fa8ec5cfc08203e21ce96a7e80a8beb63d83f0a794
SSDEEP 48:CKJ13yPZnF3OANzjszbdbPhOhBFTSBjsb5P4oyl19yVg8/VdzsUTlJzZ:LiPZFP1jwOSBjy5P4oyn9Wn9JxpJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

peqsj.on

Path C:\Users\Admin\AppData\Local\Temp\peqsj.on
Size 263KB
SHA256 559d47bad2991d7a7597578731915661be5299edb0a921b518e22bc64d504b9a
MD5 80963b38272939dd3b137e7d104c34d8
SHA1 5af25f765f97c79e29bed80516128b161ffa6713
SHA512 aa522ff75277aea699aabac7c50969e5b45d493d90345019966aa9cc40d05923e679c7b4ed822d162528708d45d1fa1fcf02ca3f323d90f8f3c5faf9fd1e767e
SSDEEP 6144:kFjJaFBtKC8TVJl7KAY1WvD6GaUySvb8M26FkauNZ4oYY84:QJ0OCMv7G1c6ZuXLkhNZ4Gn
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjnmul.exe

Path \Users\Admin\AppData\Local\Temp\hjnmul.exe
Size 4KB
SHA256 505968cc347bc2950b3bf892560f23c9c7c4ea9dfad398505b118f477f275e37
MD5 54decb55baf865b63e577ee2dfdb5f40
SHA1 543870daede33b94934c4e3cbf1df71684f83399
SHA512 f5d86e4151af6b2e7c266368cf28d57265e71b56db337bfa7af3f1720282fd710bb87d6690c5e029a37760fa8ec5cfc08203e21ce96a7e80a8beb63d83f0a794
SSDEEP 48:CKJ13yPZnF3OANzjszbdbPhOhBFTSBjsb5P4oyl19yVg8/VdzsUTlJzZ:LiPZFP1jwOSBjy5P4oyn9Wn9JxpJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjnmul.exe

Path \Users\Admin\AppData\Local\Temp\hjnmul.exe
Size 4KB
SHA256 505968cc347bc2950b3bf892560f23c9c7c4ea9dfad398505b118f477f275e37
MD5 54decb55baf865b63e577ee2dfdb5f40
SHA1 543870daede33b94934c4e3cbf1df71684f83399
SHA512 f5d86e4151af6b2e7c266368cf28d57265e71b56db337bfa7af3f1720282fd710bb87d6690c5e029a37760fa8ec5cfc08203e21ce96a7e80a8beb63d83f0a794
SSDEEP 48:CKJ13yPZnF3OANzjszbdbPhOhBFTSBjsb5P4oyl19yVg8/VdzsUTlJzZ:LiPZFP1jwOSBjy5P4oyn9Wn9JxpJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjnmul.exe

Path \Users\Admin\AppData\Local\Temp\hjnmul.exe
Size 4KB
SHA256 505968cc347bc2950b3bf892560f23c9c7c4ea9dfad398505b118f477f275e37
MD5 54decb55baf865b63e577ee2dfdb5f40
SHA1 543870daede33b94934c4e3cbf1df71684f83399
SHA512 f5d86e4151af6b2e7c266368cf28d57265e71b56db337bfa7af3f1720282fd710bb87d6690c5e029a37760fa8ec5cfc08203e21ce96a7e80a8beb63d83f0a794
SSDEEP 48:CKJ13yPZnF3OANzjszbdbPhOhBFTSBjsb5P4oyl19yVg8/VdzsUTlJzZ:LiPZFP1jwOSBjy5P4oyn9Wn9JxpJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-68-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/464-71-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/464-73-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/464-74-0x0000000000390000-0x00000000003C0000-memory.dmp

Download

memory/464-75-0x00000000044D0000-0x0000000004510000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads