agenttesla | e867bb597f0b2dc98057b12a90fcef9eca9e78ae1081370f89593f0d210a5acb

General

Target

vbc.exe
Size

790KB
MD5

425124613fb9b4daa38460652fd75e38
SHA1

542aaee07bd064ec6384685fa9ce9299915fb680
SHA256

e867bb597f0b2dc98057b12a90fcef9eca9e78ae1081370f89593f0d210a5acb
SHA512

915a482bd97fa5ac8e388b46bb89e011742595a56902c65fbba0edb1b218a1b600a31c7bf3cc2735c02f3f9b6d59995ebf9203e2701ad8cd03c7a2316e1208dd
SSDEEP

24576:ImVZ9mZojJlboENPVbI/4WgyJMLpLJwK:93sojkEP1LWTep+K

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5663632223:AAG5KHZDs7KWoaqTYx3lSyFlOdfD9vGegQo/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\eubJfun = "C:\\Users\\Admin\\AppData\\Roaming\\eubJfun\\eubJfun.exe"	vbc.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 1244 set thread context of 1328 1244 vbc.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

840 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

vbc.exepowershell.exe

pid process

1244 vbc.exe
1244 vbc.exe
440 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vbc.exevbc.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1244 vbc.exe
Token: SeDebugPrivilege 1328 vbc.exe
Token: SeDebugPrivilege 440 powershell.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 1244 set thread context of 1328	1244	vbc.exe	vbc.exe

pid	process
840	schtasks.exe

pid	process
1244	vbc.exe
1244	vbc.exe
440	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1244	vbc.exe
Token: SeDebugPrivilege	1328	vbc.exe
Token: SeDebugPrivilege	440	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

vbc.exe

description	pid	process	target process
PID 1244 wrote to memory of 440	1244	vbc.exe	powershell.exe
PID 1244 wrote to memory of 440	1244	vbc.exe	powershell.exe
PID 1244 wrote to memory of 440	1244	vbc.exe	powershell.exe
PID 1244 wrote to memory of 440	1244	vbc.exe	powershell.exe
PID 1244 wrote to memory of 840	1244	vbc.exe	schtasks.exe
PID 1244 wrote to memory of 840	1244	vbc.exe	schtasks.exe
PID 1244 wrote to memory of 840	1244	vbc.exe	schtasks.exe
PID 1244 wrote to memory of 840	1244	vbc.exe	schtasks.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe
PID 1244 wrote to memory of 1328	1244	vbc.exe	vbc.exe

outlook_office_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RnzqvRAlVCaDTf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RnzqvRAlVCaDTf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC4D6.tmp"
2⤵
- Creates scheduled task(s)
PID:840

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC4D6.tmp
Filesize
1KB

MD5
677df220ac5a1ec04a56d626bc7a19ee

SHA1
b5cb3d6043cf4fd4094571562a620c62f5784e73

SHA256
7e3fa597244039824a44babf28b72dbf8db24521984f2a42d5a66e85bf97ba9a

SHA512
f5e331895c6ed9cea8fccc30b9b88722b880d402e27a6c13a3d54e23c6b23bc745b0528ddc0c4d31aaff9f293cb903cec1b285a0ffcc1e20b751afe472e2cdea

Download Submit
memory/1244-54-0x0000000000AE0000-0x0000000000BAC000-memory.dmp

Filesize
816KB

Download
memory/1244-55-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/1244-56-0x00000000004F0000-0x0000000000510000-memory.dmp

Filesize
128KB

Download
memory/1244-57-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/1244-58-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/1244-59-0x0000000005710000-0x00000000057BA000-memory.dmp

Filesize
680KB

Download
memory/1244-65-0x00000000045F0000-0x0000000004622000-memory.dmp

Filesize
200KB

Download
memory/1328-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1328-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1328-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1328-68-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1328-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1328-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1328-73-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1328-75-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1328-78-0x00000000045F0000-0x0000000004630000-memory.dmp

Filesize
256KB

Download
memory/1328-97-0x00000000045F0000-0x0000000004630000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads