agenttesla | 0667f28a0d30bacde293358f9fe655f0650fed4efd2ffbdf25123ae10350b50e

General

Target

Bill Of Lading.exe
Size

266KB
MD5

cbcf7349a287adfbdb49c5bfbdd370ca
SHA1

3fb0aacfaddf5b88c9ec9b8714ea32e7e4661977
SHA256

0667f28a0d30bacde293358f9fe655f0650fed4efd2ffbdf25123ae10350b50e
SHA512

15050493942dac65a7ec554deadbb2fa06a78f1a9d6ff8d0ff74d6ceacbb8c8d473bb0aa39b7136afef942a33c6303adae5868399546b4fd092754dc4af81265
SSDEEP

6144:/Ya6gY4l4+x/yE/L6J1D8xTYUFnRr9ATJmsdFu3s99vWtmS/:/Y2Y4l4+xaOM1D8xTHaTJmUucHS/

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Loads dropped DLL 1 IoCs

pid	Process
3560	Bill Of Lading.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bill Of Lading.exe
Key opened	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bill Of Lading.exe
Key opened	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bill Of Lading.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3560 set thread context of 4676	3560	Bill Of Lading.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	Bill Of Lading.exe
4676	Bill Of Lading.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3560	Bill Of Lading.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	Bill Of Lading.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 4676	3560	Bill Of Lading.exe	82
PID 3560 wrote to memory of 4676	3560	Bill Of Lading.exe	82
PID 3560 wrote to memory of 4676	3560	Bill Of Lading.exe	82
PID 3560 wrote to memory of 4676	3560	Bill Of Lading.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bill Of Lading.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bill Of Lading.exe

C:\Users\Admin\AppData\Local\Temp\Bill Of Lading.exe
"C:\Users\Admin\AppData\Local\Temp\Bill Of Lading.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Local\Temp\Bill Of Lading.exe
  "C:\Users\Admin\AppData\Local\Temp\Bill Of Lading.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst8515.tmp\qahbuy.dll

Filesize
6KB

MD5
55575bd8497db3a09afaea37bf6b21f1

SHA1
3ad640e9e47b57371043e1938ad09cc395ea093b

SHA256
7702149a00a089f50918926db64b504c9d8ece13ede91bb93e6bf666a1d31151

SHA512
6a29035563b70ba7568c3cb252862d0bfc81e384cd113f154078b91a58aed1738ec98122d835c018dbdcd7c8a4e7f8eeb3edc18f0c1405ae72999bd31da3c6ac

Download Submit
memory/4676-139-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4676-140-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4676-141-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4676-142-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4676-143-0x0000000004A40000-0x0000000004FE4000-memory.dmp

Filesize
5.6MB

Download
memory/4676-144-0x0000000004FF0000-0x0000000005056000-memory.dmp

Filesize
408KB

Download
memory/4676-145-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4676-146-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4676-147-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4676-148-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4676-149-0x00000000055A0000-0x00000000055F0000-memory.dmp

Filesize
320KB

Download
memory/4676-150-0x00000000055F0000-0x00000000057B2000-memory.dmp

Filesize
1.8MB

Download
memory/4676-151-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/4676-152-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/4676-154-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4676-155-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4676-156-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4676-157-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing