agenttesla | b4360f2d64d4b59c5dd1b56ccb7ed8233eeddd871fff3dd4ca9f9bead820cdb8

General

Target

new-order_20191102_073809_405251-PDF.exe
Size

730KB
MD5

4befd99de8dedfeeb5cc7062663f561e
SHA1

670fa767ca9a9944896d98c1c14a05529c5579f7
SHA256

b4360f2d64d4b59c5dd1b56ccb7ed8233eeddd871fff3dd4ca9f9bead820cdb8
SHA512

9d990e844d00bf8c6df40f7d415911c7f946d9e9cd2c5bc627ce29b9e5174bf3308b22ceb84954e00c5364b0759165347cec79e624468aa953658799717f3cc0
SSDEEP

12288:UY+IO6T88SoOiIiKApCq6/6mNGH3igjDrnLSmvc+0ZV7WYJgqFI:UY+/288bOMB0Nq3rDZc+wgZ

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6261006732:AAFiMpPz79k5Wkkw0xvICpfaipqXFQbQmmo/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2028	ftqjwve.exe
1976	ftqjwve.exe

Loads dropped DLL 2 IoCs

pid	Process
1808	new-order_20191102_073809_405251-PDF.exe
2028	ftqjwve.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 1976	2028	ftqjwve.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2028	ftqjwve.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	ftqjwve.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	ftqjwve.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2028	1808	new-order_20191102_073809_405251-PDF.exe	28
PID 1808 wrote to memory of 2028	1808	new-order_20191102_073809_405251-PDF.exe	28
PID 1808 wrote to memory of 2028	1808	new-order_20191102_073809_405251-PDF.exe	28
PID 1808 wrote to memory of 2028	1808	new-order_20191102_073809_405251-PDF.exe	28
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29
PID 2028 wrote to memory of 1976	2028	ftqjwve.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftqjwve.exe

C:\Users\Admin\AppData\Local\Temp\new-order_20191102_073809_405251-PDF.exe
"C:\Users\Admin\AppData\Local\Temp\new-order_20191102_073809_405251-PDF.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe
  "C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe" C:\Users\Admin\AppData\Local\Temp\kmsiwtjwgxf.ksq
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe
    "C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cagtsze.nme

Filesize
262KB

MD5
59136ada55e21031dc58896455f1a3fd

SHA1
20b6c89147d2aabd6ba20106f69479a4b9d2019c

SHA256
b2f23b411d7d4a776f7859f46fa639984eaecab6963c400e71d49d91b2b63146

SHA512
72e9edc201cd2f19a3cea468ca687d48782d53042794b49ec7822e8cc0cbf4d43d68b018f04c92e27780eb9e3dda3966abd9ab120e054a215f5518d0623667cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe

Filesize
323KB

MD5
7760393f3fa0eabbe73f5313d4afd786

SHA1
ab7e49f3f287cdf11bf8783fe25c21247e08b4e2

SHA256
6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba

SHA512
71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374

Download Submit
C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe

Filesize
323KB

MD5
7760393f3fa0eabbe73f5313d4afd786

SHA1
ab7e49f3f287cdf11bf8783fe25c21247e08b4e2

SHA256
6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba

SHA512
71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374

Download Submit
C:\Users\Admin\AppData\Local\Temp\ftqjwve.exe

Filesize
323KB

MD5
7760393f3fa0eabbe73f5313d4afd786

SHA1
ab7e49f3f287cdf11bf8783fe25c21247e08b4e2

SHA256
6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba

SHA512
71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374

Download Submit
C:\Users\Admin\AppData\Local\Temp\kmsiwtjwgxf.ksq

Filesize
5KB

MD5
e7a050fa398df8890027dfa27cf0bd4c

SHA1
1049f60f10828a36ed54900dea59c69f1601a91e

SHA256
d785f27be71e26a1c4cdcea16f78d5240e246efd48aad5d26621490b7c702c7b

SHA512
5cb61b7d9f04eb5af7cc02da3a374330e0dcdf1bff48d110ce5b8e2c1ed549faddfb0bd4db86060f0beffc98c01685e84d4820c26db28f15a490128d0bc299ed

Download Submit
\Users\Admin\AppData\Local\Temp\ftqjwve.exe

Filesize
323KB

MD5
7760393f3fa0eabbe73f5313d4afd786

SHA1
ab7e49f3f287cdf11bf8783fe25c21247e08b4e2

SHA256
6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba

SHA512
71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374

Download Submit
\Users\Admin\AppData\Local\Temp\ftqjwve.exe

Filesize
323KB

MD5
7760393f3fa0eabbe73f5313d4afd786

SHA1
ab7e49f3f287cdf11bf8783fe25c21247e08b4e2

SHA256
6e5a6f9409d5a071fb1a3fca7721993eb527aac12be9420c2401a33b41cb47ba

SHA512
71044983e875aad9b14762dd790a01daa73f84f3b912c62681d4193b1df623844343b903307197f24403e755fc0215f1a0421baef5bd9a0ad5e2e04a115e2374

Download Submit
memory/1976-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1976-68-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1976-70-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1976-71-0x0000000001CA0000-0x0000000001CD0000-memory.dmp

Filesize
192KB

Download
memory/1976-72-0x0000000004490000-0x00000000044D0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing