agenttesla | 87214f349c6c4a1dd838d005fd0a6bbac96d1cf77b954a9ce33c66006d090cf0

General

Target

Order Spec 122001400100.exe
Size

318KB
MD5

4d9e63c46ed5f1fdfbbb41b2088f411c
SHA1

65632c2913f5d25e518c1d4760b21fb4441aac86
SHA256

87214f349c6c4a1dd838d005fd0a6bbac96d1cf77b954a9ce33c66006d090cf0
SHA512

42d5fc250b0c0f004e747c42eee537e45d8b5d4cafde3c8acbf5617f223f90492e1132a23de86762fa273c82871b0f666c449b3f3eff9ebd5c1eb29adfd806b4
SSDEEP

6144:vYa6CVvPsNEPYWv/6Z9baO31qC6vd94BJGt9SFjy/F/A3ukRN/:vYMN0xy6DbaOFqhyGfh/t/4R

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

dnghzmauol.exednghzmauol.exe

pid process

2956 dnghzmauol.exe
2248 dnghzmauol.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2956	dnghzmauol.exe
2248	dnghzmauol.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

dnghzmauol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dnghzmauol.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dnghzmauol.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dnghzmauol.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dnghzmauol.exe

description pid process target process

PID 2956 set thread context of 2248 2956 dnghzmauol.exe dnghzmauol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

dnghzmauol.exe

pid process

2956 dnghzmauol.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dnghzmauol.exe

description pid process

Token: SeDebugPrivilege 2248 dnghzmauol.exe

description	pid	process	target process
PID 2956 set thread context of 2248	2956	dnghzmauol.exe	dnghzmauol.exe

pid	process
2956	dnghzmauol.exe

description	pid	process
Token: SeDebugPrivilege	2248	dnghzmauol.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Order Spec 122001400100.exednghzmauol.exe

description	pid	process	target process
PID 2364 wrote to memory of 2956	2364	Order Spec 122001400100.exe	dnghzmauol.exe
PID 2364 wrote to memory of 2956	2364	Order Spec 122001400100.exe	dnghzmauol.exe
PID 2364 wrote to memory of 2956	2364	Order Spec 122001400100.exe	dnghzmauol.exe
PID 2956 wrote to memory of 2248	2956	dnghzmauol.exe	dnghzmauol.exe
PID 2956 wrote to memory of 2248	2956	dnghzmauol.exe	dnghzmauol.exe
PID 2956 wrote to memory of 2248	2956	dnghzmauol.exe	dnghzmauol.exe
PID 2956 wrote to memory of 2248	2956	dnghzmauol.exe	dnghzmauol.exe

outlook_office_path 1 IoCs

Processes:

dnghzmauol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dnghzmauol.exe

outlook_win_path 1 IoCs

Processes:

dnghzmauol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dnghzmauol.exe

C:\Users\Admin\AppData\Local\Temp\Order Spec 122001400100.exe
"C:\Users\Admin\AppData\Local\Temp\Order Spec 122001400100.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Users\Admin\AppData\Local\Temp\dnghzmauol.exe
"C:\Users\Admin\AppData\Local\Temp\dnghzmauol.exe" C:\Users\Admin\AppData\Local\Temp\sebcx.do
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2956

C:\Users\Admin\AppData\Local\Temp\dnghzmauol.exe
"C:\Users\Admin\AppData\Local\Temp\dnghzmauol.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cgqwlabnp.azn
Filesize
262KB

MD5
f8a0f47588d8977a67454efba8cb4948

SHA1
6384db508ad910c891fac93d18e6401219e73ac7

SHA256
3f9c4243629119b02097a827a6198760bf6004a1eee2d0da8deaf3a2d465a60f

SHA512
2f8fb83eb88a7bd6d16a896504cff8afa0ce72edc6d6acd9aa3f852ee0dcc287401bc922087b7085c2f77f772ced233cdcbc1f4e7bb9543c7014994010ad876e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dnghzmauol.exe
Filesize
108KB

MD5
1f4ac6a4a2fe279b1ab731afe0c7087e

SHA1
c84769ff37ee558c7f37c5c40ef03f36cb7f8f52

SHA256
1ee50c13963ba8c141c9995af7a01089d5fc57315b09945c5aa3a984ef8a3ba0

SHA512
700d24caf59b288d1cdbb990d107b48c69fcb8b20a1b1f4d175031a04fa2222186494e85ba85be2b3895b12ba230e82fc043bf6ef87c9d921444341b8c7955f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dnghzmauol.exe
Filesize
108KB

MD5
1f4ac6a4a2fe279b1ab731afe0c7087e

SHA1
c84769ff37ee558c7f37c5c40ef03f36cb7f8f52

SHA256
1ee50c13963ba8c141c9995af7a01089d5fc57315b09945c5aa3a984ef8a3ba0

SHA512
700d24caf59b288d1cdbb990d107b48c69fcb8b20a1b1f4d175031a04fa2222186494e85ba85be2b3895b12ba230e82fc043bf6ef87c9d921444341b8c7955f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dnghzmauol.exe
Filesize
108KB

MD5
1f4ac6a4a2fe279b1ab731afe0c7087e

SHA1
c84769ff37ee558c7f37c5c40ef03f36cb7f8f52

SHA256
1ee50c13963ba8c141c9995af7a01089d5fc57315b09945c5aa3a984ef8a3ba0

SHA512
700d24caf59b288d1cdbb990d107b48c69fcb8b20a1b1f4d175031a04fa2222186494e85ba85be2b3895b12ba230e82fc043bf6ef87c9d921444341b8c7955f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\sebcx.do
Filesize
5KB

MD5
4dd10a2acbd323f745a69f123fce1733

SHA1
ce7cad4836b3a7325dfdbd15714e2e4025859d0f

SHA256
41f7bc5a9bdce68a49056f99bc23abf9289fb955bdeca5f5230e952c652e2ccd

SHA512
01e5faf28b37c36563036670b653192293d46b5c52e7e6007efd47609ca294ae5620bfaa641cfeaedefa8b1d0155faecf023963ce311fe0693cf82d1276e3fa0

Download Submit
memory/2248-148-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2248-152-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2248-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2248-146-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2248-147-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2248-141-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2248-149-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2248-150-0x0000000005FF0000-0x0000000006594000-memory.dmp

Filesize
5.6MB

Download
memory/2248-151-0x00000000059B0000-0x0000000005A16000-memory.dmp

Filesize
408KB

Download
memory/2248-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2248-153-0x0000000006880000-0x0000000006912000-memory.dmp

Filesize
584KB

Download
memory/2248-154-0x0000000006850000-0x000000000685A000-memory.dmp

Filesize
40KB

Download
memory/2248-155-0x0000000006B20000-0x0000000006B70000-memory.dmp

Filesize
320KB

Download
memory/2248-156-0x0000000006D40000-0x0000000006F02000-memory.dmp

Filesize
1.8MB

Download
memory/2248-158-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2248-157-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2248-159-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2248-160-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads