agenttesla | 7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

General

Target

qFbGYuKhG1.exe
Size

647KB
MD5

4f34b0b75d7b9ebf3fbd77915cba976f
SHA1

6b8a77a3a2c4a24c8ad7837fbf4c36e822953345
SHA256

7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f
SHA512

c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3
SSDEEP

12288:MQw8m/eoBcBWYwywwpyuTdHEnyzW8M1s9d8fYf9/Ksq/KsI/Ksp:qNBcBWYYwD+KW8HkMtio5

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kumbarasigorta.com
Port:
587
Username:
[email protected]
Password:
Ceren1234.
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

qFbGYuKhG1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	qFbGYuKhG1.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

4636 svchost.exe

pid	process
4636	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

jsc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

qFbGYuKhG1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	qFbGYuKhG1.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 api.ipify.org
19 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 4636 set thread context of 2616 4636 svchost.exe jsc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4780 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1924 timeout.exe

flow	ioc
20	api.ipify.org
19	api.ipify.org

description	pid	process	target process
PID 4636 set thread context of 2616	4636	svchost.exe	jsc.exe

pid	process
4780	schtasks.exe

pid	process
1924	timeout.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

qFbGYuKhG1.exesvchost.exe

pid	process
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4436	qFbGYuKhG1.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

qFbGYuKhG1.exesvchost.exejsc.exe

description pid process

Token: SeDebugPrivilege 4436 qFbGYuKhG1.exe
Token: SeDebugPrivilege 4636 svchost.exe
Token: SeDebugPrivilege 2616 jsc.exe

description	pid	process
Token: SeDebugPrivilege	4436	qFbGYuKhG1.exe
Token: SeDebugPrivilege	4636	svchost.exe
Token: SeDebugPrivilege	2616	jsc.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

qFbGYuKhG1.execmd.execmd.exesvchost.exe

description	pid	process	target process
PID 4436 wrote to memory of 4872	4436	qFbGYuKhG1.exe	cmd.exe
PID 4436 wrote to memory of 4872	4436	qFbGYuKhG1.exe	cmd.exe
PID 4436 wrote to memory of 4040	4436	qFbGYuKhG1.exe	cmd.exe
PID 4436 wrote to memory of 4040	4436	qFbGYuKhG1.exe	cmd.exe
PID 4040 wrote to memory of 1924	4040	cmd.exe	timeout.exe
PID 4040 wrote to memory of 1924	4040	cmd.exe	timeout.exe
PID 4872 wrote to memory of 4780	4872	cmd.exe	schtasks.exe
PID 4872 wrote to memory of 4780	4872	cmd.exe	schtasks.exe
PID 4040 wrote to memory of 4636	4040	cmd.exe	svchost.exe
PID 4040 wrote to memory of 4636	4040	cmd.exe	svchost.exe
PID 4636 wrote to memory of 4344	4636	svchost.exe	cvtres.exe
PID 4636 wrote to memory of 4344	4636	svchost.exe	cvtres.exe
PID 4636 wrote to memory of 4304	4636	svchost.exe	ngentask.exe
PID 4636 wrote to memory of 4304	4636	svchost.exe	ngentask.exe
PID 4636 wrote to memory of 4584	4636	svchost.exe	csc.exe
PID 4636 wrote to memory of 4584	4636	svchost.exe	csc.exe
PID 4636 wrote to memory of 1356	4636	svchost.exe	SMSvcHost.exe
PID 4636 wrote to memory of 1356	4636	svchost.exe	SMSvcHost.exe
PID 4636 wrote to memory of 2252	4636	svchost.exe	dfsvc.exe
PID 4636 wrote to memory of 2252	4636	svchost.exe	dfsvc.exe
PID 4636 wrote to memory of 1988	4636	svchost.exe	DataSvcUtil.exe
PID 4636 wrote to memory of 1988	4636	svchost.exe	DataSvcUtil.exe
PID 4636 wrote to memory of 4740	4636	svchost.exe	ilasm.exe
PID 4636 wrote to memory of 4740	4636	svchost.exe	ilasm.exe
PID 4636 wrote to memory of 1420	4636	svchost.exe	ServiceModelReg.exe
PID 4636 wrote to memory of 1420	4636	svchost.exe	ServiceModelReg.exe
PID 4636 wrote to memory of 2748	4636	svchost.exe	aspnet_wp.exe
PID 4636 wrote to memory of 2748	4636	svchost.exe	aspnet_wp.exe
PID 4636 wrote to memory of 3244	4636	svchost.exe	RegSvcs.exe
PID 4636 wrote to memory of 3244	4636	svchost.exe	RegSvcs.exe
PID 4636 wrote to memory of 4464	4636	svchost.exe	mscorsvw.exe
PID 4636 wrote to memory of 4464	4636	svchost.exe	mscorsvw.exe
PID 4636 wrote to memory of 3108	4636	svchost.exe	aspnet_regsql.exe
PID 4636 wrote to memory of 3108	4636	svchost.exe	aspnet_regsql.exe
PID 4636 wrote to memory of 2616	4636	svchost.exe	jsc.exe
PID 4636 wrote to memory of 2616	4636	svchost.exe	jsc.exe
PID 4636 wrote to memory of 2616	4636	svchost.exe	jsc.exe
PID 4636 wrote to memory of 2616	4636	svchost.exe	jsc.exe
PID 4636 wrote to memory of 2616	4636	svchost.exe	jsc.exe
PID 4636 wrote to memory of 2616	4636	svchost.exe	jsc.exe
PID 4636 wrote to memory of 2616	4636	svchost.exe	jsc.exe
PID 4636 wrote to memory of 2616	4636	svchost.exe	jsc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

jsc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

Processes:

jsc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\qFbGYuKhG1.exe
"C:\Users\Admin\AppData\Local\Temp\qFbGYuKhG1.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
3⤵
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB098.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1924

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
4⤵
PID:4344

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
4⤵
PID:4304

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
4⤵
PID:4584

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
4⤵
PID:1356

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
4⤵
PID:2252

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
4⤵
PID:1988

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
4⤵
PID:4740

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
4⤵
PID:1420

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
4⤵
PID:2748

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
4⤵
PID:3244

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
4⤵
PID:4464

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
4⤵
PID:3108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
4⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB098.tmp.bat
Filesize
151B

MD5
24910e0984352cdd0a504fdbd7fb6260

SHA1
3786bccffa094d613cd45c7d0e52845be6db3c54

SHA256
a0b0eac72f12a108a54af40cd0ca3db696fd76987b68c3beb8087120ff541ee5

SHA512
754905a490a1d0f0685e343cb51e256871d46732ea9e38b71886074206e549f33d8eaa40351834e5830542cfd85d5c093bb63db2a8d78fc8bdc093d2c0ee7638

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
647KB

MD5
4f34b0b75d7b9ebf3fbd77915cba976f

SHA1
6b8a77a3a2c4a24c8ad7837fbf4c36e822953345

SHA256
7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

SHA512
c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
647KB

MD5
4f34b0b75d7b9ebf3fbd77915cba976f

SHA1
6b8a77a3a2c4a24c8ad7837fbf4c36e822953345

SHA256
7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

SHA512
c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3

Download Submit
memory/2616-147-0x0000000005520000-0x0000000005AC4000-memory.dmp

Filesize
5.6MB

Download
memory/2616-145-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2616-148-0x0000000004EE0000-0x0000000004F46000-memory.dmp

Filesize
408KB

Download
memory/2616-149-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/2616-150-0x00000000068D0000-0x0000000006962000-memory.dmp

Filesize
584KB

Download
memory/2616-151-0x00000000068A0000-0x00000000068AA000-memory.dmp

Filesize
40KB

Download
memory/2616-152-0x0000000006AC0000-0x0000000006B10000-memory.dmp

Filesize
320KB

Download
memory/2616-153-0x0000000006CF0000-0x0000000006EB2000-memory.dmp

Filesize
1.8MB

Download
memory/2616-154-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4436-136-0x0000017ECD330000-0x0000017ECD34E000-memory.dmp

Filesize
120KB

Download
memory/4436-135-0x0000017EE75A0000-0x0000017EE75B0000-memory.dmp

Filesize
64KB

Download
memory/4436-134-0x0000017ECEBC0000-0x0000017ECEC36000-memory.dmp

Filesize
472KB

Download
memory/4436-133-0x0000017ECCF20000-0x0000017ECCFC4000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads