agenttesla | b4360f2d64d4b59c5dd1b56ccb7ed8233eeddd871fff3dd4ca9f9bead820cdb8

Analysis

max time kernel
141s
max time network
134s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
new-order_20191102_073809_405251-PDF.exe
Size 730KB
Sample230419-kh522abc2w
SHA256 b4360f2d64d4b59c5dd1b56ccb7ed8233eeddd871fff3dd4ca9f9bead820cdb8
MD5 4befd99de8dedfeeb5cc7062663f561e
SHA1 670fa767ca9a9944896d98c1c14a05529c5579f7
SHA512 9d990e844d00bf8c6df40f7d415911c7f946d9e9cd2c5bc627ce29b9e5174bf3308b22ceb84954e00c5364b0759165347cec79e624468aa953658799717f3cc0
SSDEEP 12288:UY+IO6T88SoOiIiKApCq6/6mNGH3igjDrnLSmvc+0ZV7WYJgqFI:UY+/288bOMB0Nq3rDZc+wgZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot6261006732:AAFiMpPz79k5Wkkw0xvICpfaipqXFQbQmmo/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2028	ftqjwve.exe
1976	ftqjwve.exe

Loads dropped DLL 2 IoCs

pid	Process
1808	new-order_20191102_073809_405251-PDF.exe
2028	ftqjwve.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 1976	2028	ftqjwve.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2028	ftqjwve.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	ftqjwve.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	ftqjwve.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2028	1808	new-order_20191102_073809_405251-PDF.exe	28
PID 1808 wrote to memory of 2028	1808	new-order_20191102_073809_405251-PDF.exe	28
PID 1808 wrote to memory of 2028	1808	new-order_20191102_073809_405251-PDF.exe	28
PID 1808 wrote to memory of 2028	1808	new-order_20191102_073809_405251-PDF.exe	28
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe

C:\Users\Admin\AppData\Local\Temp\new-order_20191102_073809_405251-PDF.exe
"C:\Users\Admin\AppData\Local\Temp\new-order_20191102_073809_405251-PDF.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe
  "C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe" C:\Users\Admin\AppData\Local\Temp\kmsiwtjwgxf.ksq
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe
    "C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cagtsze.nme

Path C:\Users\Admin\AppData\Local\Temp\cagtsze.nme
Size 262KB
SHA256 b2f23b411d7d4a776f7859f46fa639984eaecab6963c400e71d49d91b2b63146
MD5 59136ada55e21031dc58896455f1a3fd
SHA1 20b6c89147d2aabd6ba20106f69479a4b9d2019c
SHA512 72e9edc201cd2f19a3cea468ca687d48782d53042794b49ec7822e8cc0cbf4d43d68b018f04c92e27780eb9e3dda3966abd9ab120e054a215f5518d0623667cd
SSDEEP 6144:BchvxJU/JMNNKPDDbKOYQ97nYDt/UU8nYL73lAe2FqdEO:BcpiiAPecyDG/Y33lH2FcL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftqjwve.exe

Path C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe
Size 323KB
SHA256 6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba
MD5 7760393f3fa0eabbe73f5313d4afd786
SHA1 ab7e49f3f287cdf11bf8783fe25c21247e08b4e2
SHA512 71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374
SSDEEP 6144:Ia7/sMtu5lWAhp+bbjVlp+UhPz3vLs5ync8lqr7zlJw6tTYg3pBwUF:/7UxpwbplpLhPM4nc8lqzuWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftqjwve.exe

Path C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe
Size 323KB
SHA256 6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba
MD5 7760393f3fa0eabbe73f5313d4afd786
SHA1 ab7e49f3f287cdf11bf8783fe25c21247e08b4e2
SHA512 71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374
SSDEEP 6144:Ia7/sMtu5lWAhp+bbjVlp+UhPz3vLs5ync8lqr7zlJw6tTYg3pBwUF:/7UxpwbplpLhPM4nc8lqzuWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftqjwve.exe

Path C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe
Size 323KB
SHA256 6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba
MD5 7760393f3fa0eabbe73f5313d4afd786
SHA1 ab7e49f3f287cdf11bf8783fe25c21247e08b4e2
SHA512 71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374
SSDEEP 6144:Ia7/sMtu5lWAhp+bbjVlp+UhPz3vLs5ync8lqr7zlJw6tTYg3pBwUF:/7UxpwbplpLhPM4nc8lqzuWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

kmsiwtjwgxf.ksq

Path C:\Users\Admin\AppData\Local\Temp\kmsiwtjwgxf.ksq
Size 5KB
SHA256 d785f27be71e26a1c4cdcea16f78d5240e246efd48aad5d26621490b7c702c7b
MD5 e7a050fa398df8890027dfa27cf0bd4c
SHA1 1049f60f10828a36ed54900dea59c69f1601a91e
SHA512 5cb61b7d9f04eb5af7cc02da3a374330e0dcdf1bff48d110ce5b8e2c1ed549faddfb0bd4db86060f0beffc98c01685e84d4820c26db28f15a490128d0bc299ed
SSDEEP 96:Farc6oYlg/DrYujk2XO5oSwY/o6R2KS4d2d9z9tPa6kAbZafuyfiAvUX7fRIscE+:FarcR5bhX1S9Qi69zHDofuyXvUX7fR+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftqjwve.exe

Path \Users\Admin\AppData\Local\Temp\ftqjwve.exe
Size 323KB
SHA256 6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba
MD5 7760393f3fa0eabbe73f5313d4afd786
SHA1 ab7e49f3f287cdf11bf8783fe25c21247e08b4e2
SHA512 71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374
SSDEEP 6144:Ia7/sMtu5lWAhp+bbjVlp+UhPz3vLs5ync8lqr7zlJw6tTYg3pBwUF:/7UxpwbplpLhPM4nc8lqzuWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftqjwve.exe

Path \Users\Admin\AppData\Local\Temp\ftqjwve.exe
Size 323KB
SHA256 6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba
MD5 7760393f3fa0eabbe73f5313d4afd786
SHA1 ab7e49f3f287cdf11bf8783fe25c21247e08b4e2
SHA512 71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374
SSDEEP 6144:Ia7/sMtu5lWAhp+bbjVlp+UhPz3vLs5ync8lqr7zlJw6tTYg3pBwUF:/7UxpwbplpLhPM4nc8lqzuWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1976-65-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1976-68-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1976-70-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1976-71-0x0000000001CA0000-0x0000000001CD0000-memory.dmp

Download

memory/1976-72-0x0000000004490000-0x00000000044D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads