agenttesla | 7ad3b811ac7212428b59433dd410b9e3413d0a5df031f7f68408dfc4aac61985

General

Target

SWIFT MT103-500M003.exe
Size

1001KB
MD5

cde8b54edcafe4791b3f08edbba15b38
SHA1

67d0f6373b599da1cb2e26ddd084f83f187b4977
SHA256

7ad3b811ac7212428b59433dd410b9e3413d0a5df031f7f68408dfc4aac61985
SHA512

699a0b761f9d3479abf1060719a7d4d920282b57aac573808da1169a5939f519db9c3e5a656b436ddc363e433b2ca62a64471810778eb7aa10ca1ad92579e85b
SSDEEP

24576:au12zVZ97Rl+QuZCYyKg8Zgp2DjmTqzFxvzn4/zO62b8+:auAR37mQYWK/ZGAjmTczraOD

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.maskanikenya.co.ke
Port:
587
Username:
[email protected]
Password:
H6@RTnNl@_=B
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

SWIFT MT103-500M003.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT MT103-500M003.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT MT103-500M003.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT MT103-500M003.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT MT103-500M003.exe

description pid process target process

PID 1340 set thread context of 1400 1340 SWIFT MT103-500M003.exe SWIFT MT103-500M003.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1124 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SWIFT MT103-500M003.exepowershell.exe

pid process

1340 SWIFT MT103-500M003.exe
1340 SWIFT MT103-500M003.exe
584 powershell.exe

description	pid	process	target process
PID 1340 set thread context of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe

pid	process
1124	schtasks.exe

pid	process
1340	SWIFT MT103-500M003.exe
1340	SWIFT MT103-500M003.exe
584	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SWIFT MT103-500M003.exeSWIFT MT103-500M003.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1340	SWIFT MT103-500M003.exe
Token: SeDebugPrivilege	1400	SWIFT MT103-500M003.exe
Token: SeDebugPrivilege	584	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

SWIFT MT103-500M003.exe

description	pid	process	target process
PID 1340 wrote to memory of 584	1340	SWIFT MT103-500M003.exe	powershell.exe
PID 1340 wrote to memory of 584	1340	SWIFT MT103-500M003.exe	powershell.exe
PID 1340 wrote to memory of 584	1340	SWIFT MT103-500M003.exe	powershell.exe
PID 1340 wrote to memory of 584	1340	SWIFT MT103-500M003.exe	powershell.exe
PID 1340 wrote to memory of 1124	1340	SWIFT MT103-500M003.exe	schtasks.exe
PID 1340 wrote to memory of 1124	1340	SWIFT MT103-500M003.exe	schtasks.exe
PID 1340 wrote to memory of 1124	1340	SWIFT MT103-500M003.exe	schtasks.exe
PID 1340 wrote to memory of 1124	1340	SWIFT MT103-500M003.exe	schtasks.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe
PID 1340 wrote to memory of 1400	1340	SWIFT MT103-500M003.exe	SWIFT MT103-500M003.exe

outlook_office_path 1 IoCs

Processes:

SWIFT MT103-500M003.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT MT103-500M003.exe

outlook_win_path 1 IoCs

Processes:

SWIFT MT103-500M003.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SWIFT MT103-500M003.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT MT103-500M003.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT MT103-500M003.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RppmpAWaGcXf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RppmpAWaGcXf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB240.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\SWIFT MT103-500M003.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT MT103-500M003.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB240.tmp

Filesize
1KB

MD5
ecc7d8f81f45929587b21da994b552d2

SHA1
db976726d316b386dcbd7491151b61bc5df3f57e

SHA256
c85cbf000cd7678dd57428aa338091c61511c4adf2b32ba6950c6ac8df02aeeb

SHA512
7776cbbea8e6bdb785b9fec64c41b154e732281a4c7446045e2cd7135015c04d349b458c57cacbf487f5415d114c2211da0e86e1728153fa3d5d19b4435c302e

Download Submit
memory/584-78-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download
memory/1340-54-0x0000000000FA0000-0x00000000010A0000-memory.dmp

Filesize
1024KB

Download
memory/1340-55-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/1340-56-0x00000000002C0000-0x00000000002E0000-memory.dmp

Filesize
128KB

Download
memory/1340-57-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/1340-58-0x0000000005860000-0x000000000590A000-memory.dmp

Filesize
680KB

Download
memory/1340-64-0x0000000000E10000-0x0000000000E42000-memory.dmp

Filesize
200KB

Download
memory/1400-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1400-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1400-68-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1400-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1400-70-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1400-72-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1400-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1400-77-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download
memory/1400-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1400-79-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads