agenttesla | 9ab4351395cfc81d8afabb133e442989b54696cad65e22de72d58398505762bd

General

Target

SOA.exe
Size

597KB
MD5

f1704d78a43bd138305e179bfadc3665
SHA1

580c3e407bdcd605bbd9aa8b028e38d646cd5f88
SHA256

9ab4351395cfc81d8afabb133e442989b54696cad65e22de72d58398505762bd
SHA512

b4d7f4e47082c3a333875b5baa5cfce739a4da48b4b36c19edb2564a2d84a1412ec432cf24e39af45c2cb97af739d9524706b05573721d689b891174f7086b61
SSDEEP

12288:ok54/mNUAviJiQ8pVcGrylGbdOrtv0vrKJTCwXRnPfQ1:ok54/QUAiY/ZylGJOBS2CoPY1

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sarahfoils.com
Port:
587
Username:
[email protected]
Password:
Scalatica01
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

SOA.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe
Key opened	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe
Key opened	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SOA.exe

description pid process target process

PID 1632 set thread context of 1956 1632 SOA.exe SOA.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1648 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

SOA.exepowershell.exepowershell.exe

pid process

1632 SOA.exe
1632 SOA.exe
1632 SOA.exe
1452 powershell.exe
1684 powershell.exe

description	pid	process	target process
PID 1632 set thread context of 1956	1632	SOA.exe	SOA.exe

pid	process
1648	schtasks.exe

pid	process
1632	SOA.exe
1632	SOA.exe
1632	SOA.exe
1452	powershell.exe
1684	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SOA.exeSOA.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1632	SOA.exe
Token: SeDebugPrivilege	1956	SOA.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

SOA.exe

description	pid	process	target process
PID 1632 wrote to memory of 1452	1632	SOA.exe	powershell.exe
PID 1632 wrote to memory of 1452	1632	SOA.exe	powershell.exe
PID 1632 wrote to memory of 1452	1632	SOA.exe	powershell.exe
PID 1632 wrote to memory of 1452	1632	SOA.exe	powershell.exe
PID 1632 wrote to memory of 1684	1632	SOA.exe	powershell.exe
PID 1632 wrote to memory of 1684	1632	SOA.exe	powershell.exe
PID 1632 wrote to memory of 1684	1632	SOA.exe	powershell.exe
PID 1632 wrote to memory of 1684	1632	SOA.exe	powershell.exe
PID 1632 wrote to memory of 1648	1632	SOA.exe	schtasks.exe
PID 1632 wrote to memory of 1648	1632	SOA.exe	schtasks.exe
PID 1632 wrote to memory of 1648	1632	SOA.exe	schtasks.exe
PID 1632 wrote to memory of 1648	1632	SOA.exe	schtasks.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe
PID 1632 wrote to memory of 1956	1632	SOA.exe	SOA.exe

outlook_office_path 1 IoCs

Processes:

SOA.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe

outlook_win_path 1 IoCs

Processes:

SOA.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SOA.exe

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AlUuFF.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AlUuFF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD431.tmp"
2⤵
- Creates scheduled task(s)
PID:1648

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD431.tmp

Filesize
1KB

MD5
874be86313c744f17d8122cb9fc0af27

SHA1
0f717d1dd620a46eff51d013fda9920a5f7dc8a1

SHA256
ddcaa4a9606b8053006c5f11e007ab438e4f6e97ec9526723debacb256880749

SHA512
8e1f0a42e84ab6f049798b25cbe0f99285f88c08e9a4cc0475948acabf9bda313e4742aed1c44fd22ea24ef709991a18eb3b08adf31bb2a218a954228b24ff21

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R8AXKV5JQB4M0HBFPKGR.temp

Filesize
7KB

MD5
71ebd1ed94e7bf0e566ca9c352ca6b1d

SHA1
e80742e062b16be77483d1edd35df4cca8b9b014

SHA256
7a43c3e690ec3e5884edaaf9c2758e703f918ec061c0b79737069adcd0e0c734

SHA512
bc3b2577dda87c8ce20b8f801bbcfc8aed1885bedfddc7c0fc290eefd3dd2470e886f155695f1f03379df4f377e4c39de264afce396ad48e3320a552dcb5243c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
71ebd1ed94e7bf0e566ca9c352ca6b1d

SHA1
e80742e062b16be77483d1edd35df4cca8b9b014

SHA256
7a43c3e690ec3e5884edaaf9c2758e703f918ec061c0b79737069adcd0e0c734

SHA512
bc3b2577dda87c8ce20b8f801bbcfc8aed1885bedfddc7c0fc290eefd3dd2470e886f155695f1f03379df4f377e4c39de264afce396ad48e3320a552dcb5243c

Download Submit
memory/1452-82-0x0000000002890000-0x00000000028D0000-memory.dmp

Filesize
256KB

Download
memory/1632-58-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/1632-59-0x0000000004C20000-0x0000000004C8A000-memory.dmp

Filesize
424KB

Download
memory/1632-54-0x0000000000C00000-0x0000000000C9C000-memory.dmp

Filesize
624KB

Download
memory/1632-57-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/1632-56-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/1632-55-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/1684-83-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/1956-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1956-75-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1956-73-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1956-77-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1956-79-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1956-81-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1956-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1956-72-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads