agenttesla | 73dd519acd12d0f745ae97a43ace2880516ef4f2682f8f5970be98418fb3cbe2

General

Target

Request For Quotation.exe
Size

210KB
MD5

849e4575b962f3ba05ec2a74e1f1bfd1
SHA1

622379e35ecdcac678bf01912a5165f7394adce1
SHA256

73dd519acd12d0f745ae97a43ace2880516ef4f2682f8f5970be98418fb3cbe2
SHA512

cf589c81163fd18a1b57f773d880f4c0901e91535a5c66065453c9bdd4c0fc838797a6c681d90413e61f9e23d3b0c151961257224d31a7d799c8e1e27d919299
SSDEEP

6144:rvFSnrnkU2HYBkiXgznK86Fg0cr14K7nDhETsn4:mrnkr0khJ6FkrCA

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.redseatransportuae.com
Port:
587
Username:
[email protected]
Password:
method10@10

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.redseatransportuae.com
Port:
587
Username:
[email protected]
Password:
method10@10
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 api.ipify.org
10 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Request For Quotation.exe

description pid process target process

PID 4664 set thread context of 3696 4664 Request For Quotation.exe Caspol.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Request For Quotation.exe

pid process

4664 Request For Quotation.exe
4664 Request For Quotation.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Request For Quotation.exeCaspol.exe

description pid process

Token: SeDebugPrivilege 4664 Request For Quotation.exe
Token: SeDebugPrivilege 3696 Caspol.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Caspol.exe

pid process

3696 Caspol.exe

flow	ioc
9	api.ipify.org
10	api.ipify.org

description	pid	process	target process
PID 4664 set thread context of 3696	4664	Request For Quotation.exe	Caspol.exe

pid	process
4664	Request For Quotation.exe
4664	Request For Quotation.exe

description	pid	process
Token: SeDebugPrivilege	4664	Request For Quotation.exe
Token: SeDebugPrivilege	3696	Caspol.exe

pid	process
3696	Caspol.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Request For Quotation.exe

description	pid	process	target process
PID 4664 wrote to memory of 2752	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 2752	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 2752	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 3696	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 3696	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 3696	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 3696	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 3696	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 3696	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 3696	4664	Request For Quotation.exe	Caspol.exe
PID 4664 wrote to memory of 3696	4664	Request For Quotation.exe	Caspol.exe

outlook_office_path 1 IoCs

Processes:

Caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

outlook_win_path 1 IoCs

Processes:

Caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

C:\Users\Admin\AppData\Local\Temp\Request For Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Quotation.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
2⤵
PID:2752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3696-134-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3696-137-0x0000000005E10000-0x00000000063B4000-memory.dmp

Filesize
5.6MB

Download
memory/3696-138-0x0000000005860000-0x00000000058C6000-memory.dmp

Filesize
408KB

Download
memory/3696-139-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/3696-140-0x0000000006EB0000-0x0000000006F42000-memory.dmp

Filesize
584KB

Download
memory/3696-141-0x0000000006F60000-0x0000000006F6A000-memory.dmp

Filesize
40KB

Download
memory/3696-142-0x0000000007110000-0x0000000007160000-memory.dmp

Filesize
320KB

Download
memory/3696-143-0x0000000007460000-0x0000000007622000-memory.dmp

Filesize
1.8MB

Download
memory/3696-150-0x0000000007290000-0x000000000732C000-memory.dmp

Filesize
624KB

Download
memory/3696-151-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4664-133-0x0000023CA4C90000-0x0000023CA4CC6000-memory.dmp

Filesize
216KB

Download
memory/4664-136-0x0000023CC0770000-0x0000023CC08BE000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads