agenttesla | 04191cb74ce838e5e1d1bfd03430d0bb3b0ad338b5d68a6e994ca50f96a554c4

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2023 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INQUIRY 03746 SRC Project.exe
Size

221KB
MD5

b0891e78e6ac318f7fe7f7c95210a1ca
SHA1

68787b0f335526a02796faff461bf94b526a3570
SHA256

746850633e9ffffd98dea2178e570537bdd30908bc9a07c58070e9186dc82074
SHA512

f354e76ec5f3a51b78a114d7c52977a3849a3b2318dcd26cfb0a619f26293678784bda2034f2ae22d15f248402fbbf0a28e59ae656c5532f1476e9b21a220a28
SSDEEP

6144:PYa64cgc4tb4NCUoSWozi28iHKU4NYIoyoH3mjZTnPsAB+S:PYucRNfWDtNYvz2BsABP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
ifeanyi@12

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Loads dropped DLL 1 IoCs

pid	Process
452	INQUIRY 03746 SRC Project.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2652-140-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/2652-142-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/2652-143-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/2652-145-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/2652-148-0x0000000004A20000-0x0000000004A30000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY 03746 SRC Project.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY 03746 SRC Project.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY 03746 SRC Project.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kgplueaj = "C:\\Users\\Admin\\AppData\\Roaming\\ytdmirnwgcluqa\\vfoktdxhdmvrb.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\INQUIRY 03746 SRC Project.exe\""	INQUIRY 03746 SRC Project.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	api.ipify.org
19	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 452 set thread context of 2652	452	INQUIRY 03746 SRC Project.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
452	INQUIRY 03746 SRC Project.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	INQUIRY 03746 SRC Project.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2652	INQUIRY 03746 SRC Project.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2652	452	INQUIRY 03746 SRC Project.exe	84
PID 452 wrote to memory of 2652	452	INQUIRY 03746 SRC Project.exe	84
PID 452 wrote to memory of 2652	452	INQUIRY 03746 SRC Project.exe	84
PID 452 wrote to memory of 2652	452	INQUIRY 03746 SRC Project.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY 03746 SRC Project.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	INQUIRY 03746 SRC Project.exe

C:\Users\Admin\AppData\Local\Temp\INQUIRY 03746 SRC Project.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY 03746 SRC Project.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\INQUIRY 03746 SRC Project.exe
  "C:\Users\Admin\AppData\Local\Temp\INQUIRY 03746 SRC Project.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:2652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsx9A53.tmp\hzgzmmfim.dll

Filesize
77KB

MD5
26e87c47bfd9f9a4550526fda4096672

SHA1
f97eb7476b3bdf2eb7b8e0753ade541ffb9ed533

SHA256
80e4bfb92bd8bc2be6078e4184761e32c8b388923167e3fb3f5579a324dc5742

SHA512
9951a335a0c9f0129183e8b1adcc394258716e934bf1f93b43a03c0d9d729ba5fa62305ac90526247e4ea64884fc3593f596dfb0f967735e0687aacbda8c7f15

Download Submit
memory/2652-140-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2652-142-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2652-143-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2652-145-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2652-144-0x0000000004A30000-0x0000000004FD4000-memory.dmp

Filesize
5.6MB

Download
memory/2652-146-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2652-147-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2652-148-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2652-149-0x0000000004FE0000-0x0000000005046000-memory.dmp

Filesize
408KB

Download
memory/2652-150-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2652-151-0x0000000005DC0000-0x0000000005E52000-memory.dmp

Filesize
584KB

Download
memory/2652-152-0x0000000005F50000-0x0000000005F5A000-memory.dmp

Filesize
40KB

Download
memory/2652-153-0x00000000060A0000-0x00000000060F0000-memory.dmp

Filesize
320KB

Download
memory/2652-154-0x0000000006130000-0x00000000062F2000-memory.dmp

Filesize
1.8MB

Download
memory/2652-161-0x0000000006310000-0x00000000063AC000-memory.dmp

Filesize
624KB

Download
memory/2652-163-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2652-164-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2652-165-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2652-166-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download