agenttesla | 506b482e8d326b6c5b603061768faa782cd3992f42fd13635405565ff6e438ee

General

Target

RFQ#86533-UNITECH STEEL.exe
Size

511KB
MD5

24a89977403150a12cc80edfef8cba76
SHA1

2ab1dbaf5a43dbfaed3f9c007f6ba2330674e1a1
SHA256

506b482e8d326b6c5b603061768faa782cd3992f42fd13635405565ff6e438ee
SHA512

83debdfe71aad18b60dae8d2e99bcb5256e4b3cc2aa1ed829078b714c186398d2b5b9cd8b0db138c5ca44bfdb37d7a3a2374f25ade663394ce1d4f958ba2e22b
SSDEEP

6144:yYa6shAp081nNxvOjqKoeKZJL/P7SlRl7EYO886VEqWfWPF61X93:yYS6nvmjqKoeeVOlRlwfT6qfuI1N

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
+O-vH!=DoS8^

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
812	wbiajhae.exe
100	wbiajhae.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wbiajhae.exe
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wbiajhae.exe
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wbiajhae.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe"	wbiajhae.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	api.ipify.org
21	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 812 set thread context of 100	812	wbiajhae.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
812	wbiajhae.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	100	wbiajhae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
100	wbiajhae.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 812	1584	RFQ#86533-UNITECH STEEL.exe	82
PID 1584 wrote to memory of 812	1584	RFQ#86533-UNITECH STEEL.exe	82
PID 1584 wrote to memory of 812	1584	RFQ#86533-UNITECH STEEL.exe	82
PID 812 wrote to memory of 100	812	wbiajhae.exe	84
PID 812 wrote to memory of 100	812	wbiajhae.exe	84
PID 812 wrote to memory of 100	812	wbiajhae.exe	84
PID 812 wrote to memory of 100	812	wbiajhae.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wbiajhae.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wbiajhae.exe

C:\Users\Admin\AppData\Local\Temp\RFQ#86533-UNITECH STEEL.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ#86533-UNITECH STEEL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\wbiajhae.exe
  "C:\Users\Admin\AppData\Local\Temp\wbiajhae.exe" C:\Users\Admin\AppData\Local\Temp\gicchqvb.gh
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Users\Admin\AppData\Local\Temp\wbiajhae.exe
    "C:\Users\Admin\AppData\Local\Temp\wbiajhae.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvhqvjfdxp.mb

Filesize
266KB

MD5
4d1b445dd9303bd0de0ad0e0eacd3e86

SHA1
622d17dac5471cc10297d8bcf826b67fd811bfd7

SHA256
0dab7defef35b06e2ee8f081008b03d4b4aee78768f09fa339f7888a97dc1adc

SHA512
aec7646c268c93a4327830ca3180acb0fa197106e9df165afc7016dff458e2092a78eb58a5a800092399f143105e0e41937f87de6183a548612f0d0f2d120a18

Download Submit
C:\Users\Admin\AppData\Local\Temp\gicchqvb.gh

Filesize
5KB

MD5
6f518f4cf16fe57286db69535be3eec6

SHA1
c9d81d8ce5bc3e98691ff20b0be170918d0fccfd

SHA256
d4f9edd22ae05a162ad746d52dd0ee2645f5d23484474d0a066154d5a943e3f0

SHA512
1fcd036ee693a3432e81271768dacceaafbf9c892c324bf07131897243060d8c39cb6941483dd53bf94bb91bd0c0117459e7fbcaf1a7ef02fc072561ae3d2cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\wbiajhae.exe

Filesize
59KB

MD5
0ff97438692fa1c5fe09ecf5dfd6512a

SHA1
06c7cae270bfa7e374e086adfad39471569569e4

SHA256
b61eb3feaa0a3de53108c94b4c69262ad70e8304b942b4c953427561abdb91b3

SHA512
90d659ba0a390a3e35ae35ef4c893182419213cab4a41b9140bca196b7ff49668d55119efd488c7a75c44396e0e17bc63d193dbfd7613e9c9f9a21cb277829e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\wbiajhae.exe

Filesize
59KB

MD5
0ff97438692fa1c5fe09ecf5dfd6512a

SHA1
06c7cae270bfa7e374e086adfad39471569569e4

SHA256
b61eb3feaa0a3de53108c94b4c69262ad70e8304b942b4c953427561abdb91b3

SHA512
90d659ba0a390a3e35ae35ef4c893182419213cab4a41b9140bca196b7ff49668d55119efd488c7a75c44396e0e17bc63d193dbfd7613e9c9f9a21cb277829e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\wbiajhae.exe

Filesize
59KB

MD5
0ff97438692fa1c5fe09ecf5dfd6512a

SHA1
06c7cae270bfa7e374e086adfad39471569569e4

SHA256
b61eb3feaa0a3de53108c94b4c69262ad70e8304b942b4c953427561abdb91b3

SHA512
90d659ba0a390a3e35ae35ef4c893182419213cab4a41b9140bca196b7ff49668d55119efd488c7a75c44396e0e17bc63d193dbfd7613e9c9f9a21cb277829e0

Download Submit
memory/100-150-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/100-152-0x00000000052C0000-0x0000000005326000-memory.dmp

Filesize
408KB

Download
memory/100-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/100-145-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/100-147-0x0000000005980000-0x0000000005F24000-memory.dmp

Filesize
5.6MB

Download
memory/100-148-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/100-149-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/100-161-0x0000000006DA0000-0x0000000006F62000-memory.dmp

Filesize
1.8MB

Download
memory/100-151-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/100-142-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/100-153-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/100-155-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/100-154-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/100-156-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/100-157-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/100-158-0x0000000006940000-0x00000000069D2000-memory.dmp

Filesize
584KB

Download
memory/100-159-0x0000000006B40000-0x0000000006B4A000-memory.dmp

Filesize
40KB

Download
memory/100-160-0x0000000006B80000-0x0000000006BD0000-memory.dmp

Filesize
320KB

Download
memory/812-140-0x0000000000720000-0x0000000000722000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing