agenttesla | 302f4c30eb86f7362b6da71e415a4dbce2bfb882fae1183d248c849603e5406e

General

Target

shipping information.exe
Size

698KB
MD5

bc2cf4b71930552ee4ef6497ee4e9ff9
SHA1

ee6102e4339928af85d80b6954c95441fd9c0420
SHA256

c2c8a9ff34e44aa56b6b40408726329e1e8e31c0e5f97d0c0849224a9c4cebb5
SHA512

dff3285e613115924016c1705a3e675b9b17011d6a3acb2c17c50669923974d294a23831c51d0c76d0bce07237e430962196bd4b2afd51b18b7a6ebdf63a157c
SSDEEP

12288:tvV+s1bSQT6tjjdB4bEOub2mWGHUAFdV9HQBPgYsQoAJItTTmEnrREjodrdODIj:ttF5ub22U+wrsQoAiVThrhdr8Dw

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.strictfacilityservices.com
Port:
587
Username:
[email protected]
Password:
SFS!@#321
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping information.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping information.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping information.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 1720	892	shipping information.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
892	shipping information.exe
700	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	shipping information.exe
Token: SeDebugPrivilege	1720	shipping information.exe
Token: SeDebugPrivilege	700	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 700	892	shipping information.exe	29
PID 892 wrote to memory of 700	892	shipping information.exe	29
PID 892 wrote to memory of 700	892	shipping information.exe	29
PID 892 wrote to memory of 700	892	shipping information.exe	29
PID 892 wrote to memory of 572	892	shipping information.exe	30
PID 892 wrote to memory of 572	892	shipping information.exe	30
PID 892 wrote to memory of 572	892	shipping information.exe	30
PID 892 wrote to memory of 572	892	shipping information.exe	30
PID 892 wrote to memory of 708	892	shipping information.exe	32
PID 892 wrote to memory of 708	892	shipping information.exe	32
PID 892 wrote to memory of 708	892	shipping information.exe	32
PID 892 wrote to memory of 708	892	shipping information.exe	32
PID 892 wrote to memory of 1720	892	shipping information.exe	33
PID 892 wrote to memory of 1720	892	shipping information.exe	33
PID 892 wrote to memory of 1720	892	shipping information.exe	33
PID 892 wrote to memory of 1720	892	shipping information.exe	33
PID 892 wrote to memory of 1720	892	shipping information.exe	33
PID 892 wrote to memory of 1720	892	shipping information.exe	33
PID 892 wrote to memory of 1720	892	shipping information.exe	33
PID 892 wrote to memory of 1720	892	shipping information.exe	33
PID 892 wrote to memory of 1720	892	shipping information.exe	33

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping information.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	shipping information.exe

C:\Users\Admin\AppData\Local\Temp\shipping information.exe
"C:\Users\Admin\AppData\Local\Temp\shipping information.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qaBIsDdS.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:700
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qaBIsDdS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp40A9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:572
- C:\Users\Admin\AppData\Local\Temp\shipping information.exe
  "C:\Users\Admin\AppData\Local\Temp\shipping information.exe"
  2⤵
  PID:708
- C:\Users\Admin\AppData\Local\Temp\shipping information.exe
  "C:\Users\Admin\AppData\Local\Temp\shipping information.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp40A9.tmp

Filesize
1KB

MD5
16e0b62acf0159d4c892ffbca5f81a81

SHA1
e452f8d60bc1f9cfb5a9c2313b749f4bd7c9687f

SHA256
71e0e8f42f034e89615db77999a65aebe8d02bc06e51e5f30877e82ffd3599be

SHA512
e14979fe2112023fb29fe426edf90a12de1d3bff3691db96abc2d28ed6a141dee8c4980250be77395c1c6bd700a6177b999f63804df52ea0c34ced461e5972c8

Download Submit
memory/700-78-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/892-55-0x0000000004350000-0x0000000004390000-memory.dmp

Filesize
256KB

Download
memory/892-56-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/892-57-0x0000000004350000-0x0000000004390000-memory.dmp

Filesize
256KB

Download
memory/892-58-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/892-59-0x0000000005B10000-0x0000000005B80000-memory.dmp

Filesize
448KB

Download
memory/892-65-0x0000000005150000-0x0000000005188000-memory.dmp

Filesize
224KB

Download
memory/892-54-0x0000000000D80000-0x0000000000E34000-memory.dmp

Filesize
720KB

Download
memory/1720-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-70-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1720-77-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-75-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-73-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-79-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/1720-80-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads