agenttesla | f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1

General

Target

f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe
Size

336KB
MD5

93aba80ef8c7ce6282497c48e7e7ccd8
SHA1

9428c1e4109c62f71fa850469a2f4374f09574f1
SHA256

f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1
SHA512

85c4fa44e3d49b04870c54ec10cc7541e7273eeb0a2e29cf6c4ef08e48fcd6cee5180bcda96074ebe95bcf86a60e59d22ca7762c0e1d9cfa791e5d45d941b319
SSDEEP

3072:lDKW1LgppLRHMY0TBfJvjcTp5XZonONL1Y111111405kKjdYz6m1hKbe:lDKW1Lgbdl0TBBvjc/ZogLXax27ib

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.marinasands.gr
Port:
587
Username:
[email protected]
Password:
;lHJ#%M!iBh-
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	api.ipify.org
34	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe
1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe
1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe
1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe
112	aspnet_compiler.exe
112	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe
Token: SeDebugPrivilege	112	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1144	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	84
PID 1232 wrote to memory of 1144	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	84
PID 1232 wrote to memory of 1144	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	84
PID 1232 wrote to memory of 388	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	85
PID 1232 wrote to memory of 388	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	85
PID 1232 wrote to memory of 388	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	85
PID 1232 wrote to memory of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86
PID 1232 wrote to memory of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86
PID 1232 wrote to memory of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86
PID 1232 wrote to memory of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86
PID 1232 wrote to memory of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86
PID 1232 wrote to memory of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86
PID 1232 wrote to memory of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86
PID 1232 wrote to memory of 112	1232	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-13-0x0000000006840000-0x0000000006890000-memory.dmp

Filesize
320KB

Download
memory/112-9-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/112-17-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/112-16-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/112-15-0x00000000068B0000-0x00000000068BA000-memory.dmp

Filesize
40KB

Download
memory/112-12-0x0000000005530000-0x0000000005596000-memory.dmp

Filesize
408KB

Download
memory/112-14-0x0000000006930000-0x00000000069C2000-memory.dmp

Filesize
584KB

Download
memory/112-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/112-11-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/1232-5-0x0000000004AD0000-0x0000000004AE4000-memory.dmp

Filesize
80KB

Download
memory/1232-10-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/1232-1-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/1232-0-0x0000000002520000-0x0000000002534000-memory.dmp

Filesize
80KB

Download
memory/1232-6-0x0000000004C10000-0x0000000004C1A000-memory.dmp

Filesize
40KB

Download
memory/1232-4-0x0000000004C30000-0x00000000051D4000-memory.dmp

Filesize
5.6MB

Download
memory/1232-3-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/1232-2-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing