agenttesla | 9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d

General

Target

9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d_JC.exe
Size

511KB
MD5

4acdd97f89db87e3d64a46ffee69717c
SHA1

d2fec96daa1bc4fc66742dfb13c0db1f516da5be
SHA256

9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d
SHA512

18be51189ae70c6e469cfd1f3b7b6c277a88412dfc100a6f8c9d4080831c85686531a1548ac50463c636df2191023afea0296ee1c9d19e34123adb7ef092f5f8
SSDEEP

12288:pYYaDT2T2u42va9wOKN6QyZzBou1g+VIe9T204n:pY1yT2Z2kvQ6BomVrEN

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2940	lebyjlumvk.exe
2284	lebyjlumvk.exe

Loads dropped DLL 2 IoCs

pid	Process
2108	9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d_JC.exe
2940	lebyjlumvk.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	lebyjlumvk.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	lebyjlumvk.exe
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	lebyjlumvk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\Myapp = "C:\\Users\\Admin\\AppData\\Roaming\\Myapp\\Myapp.exe"	lebyjlumvk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 2284	2940	lebyjlumvk.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2284	lebyjlumvk.exe
2284	lebyjlumvk.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2940	lebyjlumvk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	lebyjlumvk.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2940	2108	9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d_JC.exe	29
PID 2108 wrote to memory of 2940	2108	9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d_JC.exe	29
PID 2108 wrote to memory of 2940	2108	9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d_JC.exe	29
PID 2108 wrote to memory of 2940	2108	9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d_JC.exe	29
PID 2940 wrote to memory of 2284	2940	lebyjlumvk.exe	30
PID 2940 wrote to memory of 2284	2940	lebyjlumvk.exe	30
PID 2940 wrote to memory of 2284	2940	lebyjlumvk.exe	30
PID 2940 wrote to memory of 2284	2940	lebyjlumvk.exe	30
PID 2940 wrote to memory of 2284	2940	lebyjlumvk.exe	30

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	lebyjlumvk.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	lebyjlumvk.exe

C:\Users\Admin\AppData\Local\Temp\9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9bf932c615606080571b3cc725439bcb7409af88df7d31720c39a81b4a96f51d_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe
  "C:\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe
    "C:\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe

Filesize
200KB

MD5
d53c3e4b5015e45bf0315d6ab99eca9d

SHA1
dcd50064871a8a1767db59a647ad91eec61a80da

SHA256
e22b7ff24a4e77c740e7f03a9fde494d291acbe07559398b3d878ee6115c8d02

SHA512
35476336ba3a0990c88f063c188f36163bcd5b74d8d90627ea83cdd5878880e939473316828f00435bebdb273015fad344f8d33fc031270b3e4d35f27bbb04c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe

Filesize
200KB

MD5
d53c3e4b5015e45bf0315d6ab99eca9d

SHA1
dcd50064871a8a1767db59a647ad91eec61a80da

SHA256
e22b7ff24a4e77c740e7f03a9fde494d291acbe07559398b3d878ee6115c8d02

SHA512
35476336ba3a0990c88f063c188f36163bcd5b74d8d90627ea83cdd5878880e939473316828f00435bebdb273015fad344f8d33fc031270b3e4d35f27bbb04c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe

Filesize
200KB

MD5
d53c3e4b5015e45bf0315d6ab99eca9d

SHA1
dcd50064871a8a1767db59a647ad91eec61a80da

SHA256
e22b7ff24a4e77c740e7f03a9fde494d291acbe07559398b3d878ee6115c8d02

SHA512
35476336ba3a0990c88f063c188f36163bcd5b74d8d90627ea83cdd5878880e939473316828f00435bebdb273015fad344f8d33fc031270b3e4d35f27bbb04c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\qnthbxdih.bk

Filesize
548KB

MD5
6b0b3eccf9899e057e7f52079591ba66

SHA1
c6f3a021575a281d17bf534aa799494da0977641

SHA256
9479fe0a583e46aacf6690d5e5bc3e6ae039c7602a6dd57945eb75ba2162ed16

SHA512
f7d7bf287d32ffc98cdf850a14e47a834196b21ef422a35c8b6a8b62a0e4d69ee1c75edbd974bd111b24138033801d165f5fa241a6f76638bed9c0abd4342976

Download Submit
\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe

Filesize
200KB

MD5
d53c3e4b5015e45bf0315d6ab99eca9d

SHA1
dcd50064871a8a1767db59a647ad91eec61a80da

SHA256
e22b7ff24a4e77c740e7f03a9fde494d291acbe07559398b3d878ee6115c8d02

SHA512
35476336ba3a0990c88f063c188f36163bcd5b74d8d90627ea83cdd5878880e939473316828f00435bebdb273015fad344f8d33fc031270b3e4d35f27bbb04c7

Download Submit
\Users\Admin\AppData\Local\Temp\lebyjlumvk.exe

Filesize
200KB

MD5
d53c3e4b5015e45bf0315d6ab99eca9d

SHA1
dcd50064871a8a1767db59a647ad91eec61a80da

SHA256
e22b7ff24a4e77c740e7f03a9fde494d291acbe07559398b3d878ee6115c8d02

SHA512
35476336ba3a0990c88f063c188f36163bcd5b74d8d90627ea83cdd5878880e939473316828f00435bebdb273015fad344f8d33fc031270b3e4d35f27bbb04c7

Download Submit
memory/2284-16-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/2284-22-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2284-14-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2284-15-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2284-25-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2284-17-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2284-18-0x00000000006E0000-0x0000000000756000-memory.dmp

Filesize
472KB

Download
memory/2284-19-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2284-20-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2284-21-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/2284-10-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2284-23-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2284-24-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2940-6-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads