agenttesla | 7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

General

Target

qFbGYuKhG1.exe
Size

647KB
MD5

4f34b0b75d7b9ebf3fbd77915cba976f
SHA1

6b8a77a3a2c4a24c8ad7837fbf4c36e822953345
SHA256

7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f
SHA512

c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3
SSDEEP

12288:MQw8m/eoBcBWYwywwpyuTdHEnyzW8M1s9d8fYf9/Ksq/KsI/Ksp:qNBcBWYYwD+KW8HkMtio5

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kumbarasigorta.com
Port:
587
Username:
[email protected]
Password:
Ceren1234.
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

qFbGYuKhG1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	qFbGYuKhG1.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1580 svchost.exe

pid	process
1580	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

jsc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

qFbGYuKhG1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	qFbGYuKhG1.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 api.ipify.org
13 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 1580 set thread context of 3084 1580 svchost.exe jsc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2308 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1796 timeout.exe

flow	ioc
12	api.ipify.org
13	api.ipify.org

description	pid	process	target process
PID 1580 set thread context of 3084	1580	svchost.exe	jsc.exe

pid	process
2308	schtasks.exe

pid	process
1796	timeout.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

Processes:

qFbGYuKhG1.exesvchost.exe

pid	process
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
2560	qFbGYuKhG1.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

qFbGYuKhG1.exesvchost.exejsc.exe

description pid process

Token: SeDebugPrivilege 2560 qFbGYuKhG1.exe
Token: SeDebugPrivilege 1580 svchost.exe
Token: SeDebugPrivilege 3084 jsc.exe

description	pid	process
Token: SeDebugPrivilege	2560	qFbGYuKhG1.exe
Token: SeDebugPrivilege	1580	svchost.exe
Token: SeDebugPrivilege	3084	jsc.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

qFbGYuKhG1.execmd.execmd.exesvchost.exe

description	pid	process	target process
PID 2560 wrote to memory of 232	2560	qFbGYuKhG1.exe	cmd.exe
PID 2560 wrote to memory of 232	2560	qFbGYuKhG1.exe	cmd.exe
PID 2560 wrote to memory of 216	2560	qFbGYuKhG1.exe	cmd.exe
PID 2560 wrote to memory of 216	2560	qFbGYuKhG1.exe	cmd.exe
PID 216 wrote to memory of 1796	216	cmd.exe	timeout.exe
PID 216 wrote to memory of 1796	216	cmd.exe	timeout.exe
PID 232 wrote to memory of 2308	232	cmd.exe	schtasks.exe
PID 232 wrote to memory of 2308	232	cmd.exe	schtasks.exe
PID 216 wrote to memory of 1580	216	cmd.exe	svchost.exe
PID 216 wrote to memory of 1580	216	cmd.exe	svchost.exe
PID 1580 wrote to memory of 4904	1580	svchost.exe	AddInProcess32.exe
PID 1580 wrote to memory of 4904	1580	svchost.exe	AddInProcess32.exe
PID 1580 wrote to memory of 4904	1580	svchost.exe	AddInProcess32.exe
PID 1580 wrote to memory of 4580	1580	svchost.exe	ngen.exe
PID 1580 wrote to memory of 4580	1580	svchost.exe	ngen.exe
PID 1580 wrote to memory of 4020	1580	svchost.exe	RegAsm.exe
PID 1580 wrote to memory of 4020	1580	svchost.exe	RegAsm.exe
PID 1580 wrote to memory of 4476	1580	svchost.exe	DataSvcUtil.exe
PID 1580 wrote to memory of 4476	1580	svchost.exe	DataSvcUtil.exe
PID 1580 wrote to memory of 3160	1580	svchost.exe	WsatConfig.exe
PID 1580 wrote to memory of 3160	1580	svchost.exe	WsatConfig.exe
PID 1580 wrote to memory of 4784	1580	svchost.exe	aspnet_regsql.exe
PID 1580 wrote to memory of 4784	1580	svchost.exe	aspnet_regsql.exe
PID 1580 wrote to memory of 1524	1580	svchost.exe	ngentask.exe
PID 1580 wrote to memory of 1524	1580	svchost.exe	ngentask.exe
PID 1580 wrote to memory of 2532	1580	svchost.exe	SMSvcHost.exe
PID 1580 wrote to memory of 2532	1580	svchost.exe	SMSvcHost.exe
PID 1580 wrote to memory of 4744	1580	svchost.exe	EdmGen.exe
PID 1580 wrote to memory of 4744	1580	svchost.exe	EdmGen.exe
PID 1580 wrote to memory of 960	1580	svchost.exe	ilasm.exe
PID 1580 wrote to memory of 960	1580	svchost.exe	ilasm.exe
PID 1580 wrote to memory of 4372	1580	svchost.exe	ServiceModelReg.exe
PID 1580 wrote to memory of 4372	1580	svchost.exe	ServiceModelReg.exe
PID 1580 wrote to memory of 964	1580	svchost.exe	AppLaunch.exe
PID 1580 wrote to memory of 964	1580	svchost.exe	AppLaunch.exe
PID 1580 wrote to memory of 4000	1580	svchost.exe	AddInProcess.exe
PID 1580 wrote to memory of 4000	1580	svchost.exe	AddInProcess.exe
PID 1580 wrote to memory of 4780	1580	svchost.exe	aspnet_regbrowsers.exe
PID 1580 wrote to memory of 4780	1580	svchost.exe	aspnet_regbrowsers.exe
PID 1580 wrote to memory of 3456	1580	svchost.exe	AddInUtil.exe
PID 1580 wrote to memory of 3456	1580	svchost.exe	AddInUtil.exe
PID 1580 wrote to memory of 4364	1580	svchost.exe	dfsvc.exe
PID 1580 wrote to memory of 4364	1580	svchost.exe	dfsvc.exe
PID 1580 wrote to memory of 3372	1580	svchost.exe	mscorsvw.exe
PID 1580 wrote to memory of 3372	1580	svchost.exe	mscorsvw.exe
PID 1580 wrote to memory of 3084	1580	svchost.exe	jsc.exe
PID 1580 wrote to memory of 3084	1580	svchost.exe	jsc.exe
PID 1580 wrote to memory of 3084	1580	svchost.exe	jsc.exe
PID 1580 wrote to memory of 3084	1580	svchost.exe	jsc.exe
PID 1580 wrote to memory of 3084	1580	svchost.exe	jsc.exe
PID 1580 wrote to memory of 3084	1580	svchost.exe	jsc.exe
PID 1580 wrote to memory of 3084	1580	svchost.exe	jsc.exe
PID 1580 wrote to memory of 3084	1580	svchost.exe	jsc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

jsc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

Processes:

jsc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\qFbGYuKhG1.exe
"C:\Users\Admin\AppData\Local\Temp\qFbGYuKhG1.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:232

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
3⤵
- Creates scheduled task(s)
PID:2308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp98CA.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1796

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
4⤵
PID:4904

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
4⤵
PID:4580

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
4⤵
PID:4020

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
4⤵
PID:4476

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
4⤵
PID:3160

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
4⤵
PID:4784

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
4⤵
PID:1524

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
4⤵
PID:2532

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
4⤵
PID:4744

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
4⤵
PID:960

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
4⤵
PID:4372

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
4⤵
PID:964

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
4⤵
PID:4000

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
4⤵
PID:4780

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
4⤵
PID:3456

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
4⤵
PID:4364

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
4⤵
PID:3372

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
4⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp98CA.tmp.bat
Filesize
151B

MD5
b77f8ec21d7d0f5ca5badf51389e6401

SHA1
b0e31977ddb0a2daa1babfca37beca7f4db6ddec

SHA256
b239fe29ce79eee10d33d05b9f2b72ee59288c34e0b6ba2a6926f2911111567d

SHA512
69b0f859b48964f27c536174d9654b3538eb12a4ce6c1d3f7b7c9951b0145918d454424b72473979eceba358e37d5d1da2e0044f9bdaff5da165108290ed5d57

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
647KB

MD5
4f34b0b75d7b9ebf3fbd77915cba976f

SHA1
6b8a77a3a2c4a24c8ad7837fbf4c36e822953345

SHA256
7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

SHA512
c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
647KB

MD5
4f34b0b75d7b9ebf3fbd77915cba976f

SHA1
6b8a77a3a2c4a24c8ad7837fbf4c36e822953345

SHA256
7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

SHA512
c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3

Download Submit
memory/2560-133-0x00000233EE1B0000-0x00000233EE254000-memory.dmp

Filesize
656KB

Download
memory/2560-134-0x00000233F07A0000-0x00000233F07B0000-memory.dmp

Filesize
64KB

Download
memory/2560-135-0x00000233F0620000-0x00000233F0696000-memory.dmp

Filesize
472KB

Download
memory/2560-136-0x00000233EE5F0000-0x00000233EE60E000-memory.dmp

Filesize
120KB

Download
memory/3084-147-0x0000000005700000-0x0000000005CA4000-memory.dmp

Filesize
5.6MB

Download
memory/3084-145-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3084-148-0x0000000005200000-0x0000000005266000-memory.dmp

Filesize
408KB

Download
memory/3084-149-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/3084-150-0x0000000006AC0000-0x0000000006B52000-memory.dmp

Filesize
584KB

Download
memory/3084-151-0x0000000006CD0000-0x0000000006CDA000-memory.dmp

Filesize
40KB

Download
memory/3084-152-0x0000000006CE0000-0x0000000006D30000-memory.dmp

Filesize
320KB

Download
memory/3084-153-0x0000000006F00000-0x00000000070C2000-memory.dmp

Filesize
1.8MB

Download
memory/3084-154-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads