agenttesla | 0016ab621d330177ecb0764d435fd311978e35b9c45c1cac8be5b945c478480f

General

Target

1319f5b076dbd5b75d41c306a762b297.doc
Size

37KB
MD5

1319f5b076dbd5b75d41c306a762b297
SHA1

1682a7ef1fcea059ebf4bb1458038d55f23af836
SHA256

0016ab621d330177ecb0764d435fd311978e35b9c45c1cac8be5b945c478480f
SHA512

d2417225e5e164ef92a6a271bc56058742c245edbd62ea088352ae5509f57d32802870334339728ec11b6a74427063d1af1e4d2fb7b18b8accb02709f900face
SSDEEP

384:nprF3nfkolOCnC3p2MyM1Z5gB8iSwvxjk+tUSut/krY0jiUDhu:px3MoltC3d1Z54xw+txEqD

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.thereccorp.com
Port:
587
Username:
[email protected]
Password:
O@123456
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4052	jahah.png
3128	jahah.png

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jahah.png
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jahah.png
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jahah.png

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	api.ipify.org
29	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 3128	4052	jahah.png	88

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3668	WINWORD.EXE
3668	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3128	jahah.png
3128	jahah.png

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	jahah.png

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3668	WINWORD.EXE
3668	WINWORD.EXE
3668	WINWORD.EXE
3668	WINWORD.EXE
3668	WINWORD.EXE
3668	WINWORD.EXE
3668	WINWORD.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4052	3668	WINWORD.EXE	84
PID 3668 wrote to memory of 4052	3668	WINWORD.EXE	84
PID 3668 wrote to memory of 4052	3668	WINWORD.EXE	84
PID 4052 wrote to memory of 3128	4052	jahah.png	88
PID 4052 wrote to memory of 3128	4052	jahah.png	88
PID 4052 wrote to memory of 3128	4052	jahah.png	88
PID 4052 wrote to memory of 3128	4052	jahah.png	88
PID 4052 wrote to memory of 3128	4052	jahah.png	88
PID 4052 wrote to memory of 3128	4052	jahah.png	88
PID 4052 wrote to memory of 3128	4052	jahah.png	88
PID 4052 wrote to memory of 3128	4052	jahah.png	88

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jahah.png

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jahah.png

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1319f5b076dbd5b75d41c306a762b297.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\jahah.png
  C:\Users\Admin\AppData\Local\Temp\jahah.png
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Users\Admin\AppData\Local\Temp\jahah.png
    "C:\Users\Admin\AppData\Local\Temp\jahah.png"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jahah.png.log

Filesize
886B

MD5
1de4321733072682805c444f3c647acd

SHA1
e6f685512dd9334eba7d8c566eeacb668f3da17d

SHA256
dc7dbd177ff59eff8d07c56e48df3dbdd8ca4699023e4c03811061fb9ea73cad

SHA512
162a01f77533daab9148c84e957041f86af47f03d983d7cf400bca19396e8a799609d67835c2bee8a0e9e54c7a9ccbe8a51044aeefbd3d24d57f9f09be90c7ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\jahah.png

Filesize
273KB

MD5
908da2b3f1932cce84084df7d5ba2218

SHA1
5fae534ebc677cd5c424c0b17c45befbfd5adf97

SHA256
dcb15efeacf1cfafd9ffb895c4499a749aaba003917d22b9bbaf736f68119a6c

SHA512
405eb471570016dcaf397a53d7e86488d0cae5a08ad5f2737303ba4437591ad996e43dee680a4386bb787e9f645ed3e771527589df065c620f7d34b98d9afabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\jahah.png

Filesize
273KB

MD5
908da2b3f1932cce84084df7d5ba2218

SHA1
5fae534ebc677cd5c424c0b17c45befbfd5adf97

SHA256
dcb15efeacf1cfafd9ffb895c4499a749aaba003917d22b9bbaf736f68119a6c

SHA512
405eb471570016dcaf397a53d7e86488d0cae5a08ad5f2737303ba4437591ad996e43dee680a4386bb787e9f645ed3e771527589df065c620f7d34b98d9afabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\jahah.png

Filesize
273KB

MD5
908da2b3f1932cce84084df7d5ba2218

SHA1
5fae534ebc677cd5c424c0b17c45befbfd5adf97

SHA256
dcb15efeacf1cfafd9ffb895c4499a749aaba003917d22b9bbaf736f68119a6c

SHA512
405eb471570016dcaf397a53d7e86488d0cae5a08ad5f2737303ba4437591ad996e43dee680a4386bb787e9f645ed3e771527589df065c620f7d34b98d9afabf

Download Submit
memory/3128-174-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/3128-162-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3128-177-0x00000000068F0000-0x00000000068FA000-memory.dmp

Filesize
40KB

Download
memory/3128-176-0x0000000006A80000-0x0000000006C42000-memory.dmp

Filesize
1.8MB

Download
memory/3128-175-0x0000000006860000-0x00000000068B0000-memory.dmp

Filesize
320KB

Download
memory/3128-167-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/3128-166-0x0000000005110000-0x0000000005176000-memory.dmp

Filesize
408KB

Download
memory/3668-135-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/3668-136-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/3668-199-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/3668-198-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/3668-197-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/3668-196-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/3668-138-0x00007FFB21AB0000-0x00007FFB21AC0000-memory.dmp

Filesize
64KB

Download
memory/3668-134-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/3668-139-0x00007FFB21AB0000-0x00007FFB21AC0000-memory.dmp

Filesize
64KB

Download
memory/3668-137-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/3668-133-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

Filesize
64KB

Download
memory/4052-157-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/4052-155-0x0000000000FF0000-0x000000000103A000-memory.dmp

Filesize
296KB

Download
memory/4052-156-0x0000000005840000-0x00000000058DC000-memory.dmp

Filesize
624KB

Download
memory/4052-158-0x0000000005EE0000-0x0000000006484000-memory.dmp

Filesize
5.6MB

Download
memory/4052-161-0x0000000005A00000-0x0000000005A1E000-memory.dmp

Filesize
120KB

Download
memory/4052-160-0x0000000005AD0000-0x0000000005B46000-memory.dmp

Filesize
472KB

Download
memory/4052-159-0x0000000005A30000-0x0000000005AC2000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads