agenttesla | b733b283ee50d714ae9289b1d375dc28978b02449504f72bb904e416c439aeeb

General

Target

8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
Size

775KB
MD5

d17e59fd176aae98c150886fea60570b
SHA1

b01a5d94c62b07a26721d71e296c3fcc60488c25
SHA256

8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0
SHA512

f56f3482432628fd2b27590bd4aa5cec8903b2d6dcb3e6ffd9844d8d539aa2d9ef56ff6404e65b1d11a4024bf923461048fdd5b21751a76f7cb38e715292544f
SSDEEP

12288:E+nL4snOS4moTN3YNXNT5xu52vao4g4o2QDYEIo1qSZk8xT2F6oL:9O3moQ5xM2vao4afBS8te6o

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.redseatransportuae.com
Port:
587
Username:
[email protected]
Password:
method10@10
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
664	powershell.exe
584	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
Token: SeDebugPrivilege	484	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
Token: SeDebugPrivilege	664	powershell.exe
Token: SeDebugPrivilege	584	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
484	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 664	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	28
PID 1408 wrote to memory of 664	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	28
PID 1408 wrote to memory of 664	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	28
PID 1408 wrote to memory of 664	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	28
PID 1408 wrote to memory of 584	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	30
PID 1408 wrote to memory of 584	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	30
PID 1408 wrote to memory of 584	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	30
PID 1408 wrote to memory of 584	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	30
PID 1408 wrote to memory of 1140	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	31
PID 1408 wrote to memory of 1140	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	31
PID 1408 wrote to memory of 1140	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	31
PID 1408 wrote to memory of 1140	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	31
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34
PID 1408 wrote to memory of 484	1408	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe	34

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe

C:\Users\Admin\AppData\Local\Temp\8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
"C:\Users\Admin\AppData\Local\Temp\8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xukQFHnm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xukQFHnm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1140
- C:\Users\Admin\AppData\Local\Temp\8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe
  "C:\Users\Admin\AppData\Local\Temp\8086b51ee5ff64002102bf80e36b81650ba576903fc00965e1a947ae013aa9c0.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAD.tmp

Filesize
1KB

MD5
512f313e9deb57f064ae4f2d3ec16be6

SHA1
9b46e9f7c2a0ae9285c9583c4241264a1958cf02

SHA256
dafb666d9e3bd648d83f10a0450b577e998040a2297ee325b2616c1e4ee48700

SHA512
bc4bf1ba95f2d9744fc05481e59e3ce79b7d11d10fb6ce05df7e34179fe386dd23c405c63500bda3c4d723078c6bb1c8d2ac4ec6336a08bc5c1948e13a712d9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W6H3B797L35WCZOPBKK7.temp

Filesize
7KB

MD5
6e483f132c31194d5d6492dc7fad6f5c

SHA1
1c1625d704a42d56162fb6a83206294092525236

SHA256
7ef73e8dc8e96cd15bb5225310e08ebc5c311e227493bf45623d85c1964e749d

SHA512
9c11505e85d8b0fc1975efee02d9d885d9e3c77172893ca7b5ff83ab65856f9aef5fc9e24fa1b1e7ebe532a2fc880f65a5f7929c3c2408d18d086fc282dc7c2e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
6e483f132c31194d5d6492dc7fad6f5c

SHA1
1c1625d704a42d56162fb6a83206294092525236

SHA256
7ef73e8dc8e96cd15bb5225310e08ebc5c311e227493bf45623d85c1964e749d

SHA512
9c11505e85d8b0fc1975efee02d9d885d9e3c77172893ca7b5ff83ab65856f9aef5fc9e24fa1b1e7ebe532a2fc880f65a5f7929c3c2408d18d086fc282dc7c2e

Download Submit
memory/484-78-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/484-80-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/484-82-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/484-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/484-76-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/484-75-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/484-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/484-73-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/584-83-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/584-84-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/1408-72-0x0000000004E30000-0x0000000004E64000-memory.dmp

Filesize
208KB

Download
memory/1408-55-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download
memory/1408-56-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/1408-57-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download
memory/1408-54-0x0000000000A50000-0x0000000000B18000-memory.dmp

Filesize
800KB

Download
memory/1408-58-0x00000000008F0000-0x00000000008FA000-memory.dmp

Filesize
40KB

Download
memory/1408-59-0x00000000050D0000-0x000000000513C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads