agenttesla | c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca

General

Target

c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe
Size

549KB
MD5

d0a6a049834612331506f3f296b22185
SHA1

0fff94995240878958c1edc0b305dc73bbd98b20
SHA256

c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca
SHA512

46e8920f03b99b1f503ceaba14edcd9167953dbb664771c7489388422fe518f6b9dc75a1564760e83a41cbedc1159c67d17953fb1c9549450ad8e08eeec93412
SSDEEP

12288:z4esyKPUz5ZKXqkn1OAeD7JAOSMfNQJ5mFvcy:z4eXFzvKXqqAAeD7SORNF

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.redseatransportuae.com
Port:
587
Username:
[email protected]
Password:
method10@10
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anydesk.exe.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anydesk.exe.exe	Powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3052	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	Powershell.exe
Token: SeDebugPrivilege	3020	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3020	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3052	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	27
PID 2984 wrote to memory of 3052	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	27
PID 2984 wrote to memory of 3052	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	27
PID 2984 wrote to memory of 3052	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	27
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29
PID 2984 wrote to memory of 3020	2984	c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe
"C:\Users\Admin\AppData\Local\Temp\c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anydesk.exe.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:3020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2984-61-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download
memory/2984-55-0x00000000004A0000-0x00000000004EA000-memory.dmp

Filesize
296KB

Download
memory/2984-56-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/2984-54-0x0000000000EA0000-0x0000000000F2E000-memory.dmp

Filesize
568KB

Download
memory/3020-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3020-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3020-63-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3020-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3020-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3020-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3020-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3020-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3020-73-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/3020-80-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/3052-60-0x00000000023B0000-0x00000000023F0000-memory.dmp

Filesize
256KB

Download
memory/3052-59-0x00000000023B0000-0x00000000023F0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing