agenttesla | 0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe
Size

401KB
MD5

f111e4ac9108f1bdbb1205b23abe1d28
SHA1

66484a2da4e8a5c63c2f0ff551c281b9b9e031cc
SHA256

0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25
SHA512

b2c032ba315415b15ef8e020f4472c29e56e3a1de69a2e126bfd5c5ca2581ffdcd7cb17fffb0656c4306b058fc740d1bb31dc165eaff447896faf9254bd7bdf7
SSDEEP

12288:GYIro7VTc2oUVyl793J0rUrWbcG9m+gkOYTth:GYKo5Tcu0993Sgi94gOGth

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 4 IoCs

pid	Process
2372	qjtrdfqx.exe
2756	qjtrdfqx.exe
2956	qjtrdfqx.exe
2668	qjtrdfqx.exe

Loads dropped DLL 4 IoCs

pid	Process
3052	SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe
2372	qjtrdfqx.exe
2372	qjtrdfqx.exe
2372	qjtrdfqx.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qjtrdfqx.exe
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qjtrdfqx.exe
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qjtrdfqx.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2668	2372	qjtrdfqx.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2668	qjtrdfqx.exe
2668	qjtrdfqx.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2372	qjtrdfqx.exe
2372	qjtrdfqx.exe
2372	qjtrdfqx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	qjtrdfqx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2668	qjtrdfqx.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2372	3052	SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe	28
PID 3052 wrote to memory of 2372	3052	SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe	28
PID 3052 wrote to memory of 2372	3052	SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe	28
PID 3052 wrote to memory of 2372	3052	SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe	28
PID 2372 wrote to memory of 2756	2372	qjtrdfqx.exe	29
PID 2372 wrote to memory of 2756	2372	qjtrdfqx.exe	29
PID 2372 wrote to memory of 2756	2372	qjtrdfqx.exe	29
PID 2372 wrote to memory of 2756	2372	qjtrdfqx.exe	29
PID 2372 wrote to memory of 2956	2372	qjtrdfqx.exe	30
PID 2372 wrote to memory of 2956	2372	qjtrdfqx.exe	30
PID 2372 wrote to memory of 2956	2372	qjtrdfqx.exe	30
PID 2372 wrote to memory of 2956	2372	qjtrdfqx.exe	30
PID 2372 wrote to memory of 2668	2372	qjtrdfqx.exe	31
PID 2372 wrote to memory of 2668	2372	qjtrdfqx.exe	31
PID 2372 wrote to memory of 2668	2372	qjtrdfqx.exe	31
PID 2372 wrote to memory of 2668	2372	qjtrdfqx.exe	31
PID 2372 wrote to memory of 2668	2372	qjtrdfqx.exe	31

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qjtrdfqx.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qjtrdfqx.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe
  "C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe
    "C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"
    3⤵
    - Executes dropped EXE
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe
    "C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"
    3⤵
    - Executes dropped EXE
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe
    "C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\niqbknyexq.ia

Filesize
336KB

MD5
dc6713ed93b2207523fc05e463708bf9

SHA1
3f06025d52cde6af57781f3977908c26cc23b38d

SHA256
5de782b12df19e55fffb73f425c4ee16ee0cb351dc2de3f2e96d921b026528b8

SHA512
31df1193a563f68879bffd51d15b799327e389cec57dc4c5f451abfc703e15d08c06ffb313967b1cce1cd734396fd6766f5f6838b2753c07f4d88ed18348bb2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe

Filesize
165KB

MD5
13c5a699c800ce394b83653875357e42

SHA1
747f3d620a23fc89ce381316e02cb5b0096bd471

SHA256
a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be

SHA512
f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9

Download Submit
memory/2372-6-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2668-14-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2668-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2668-18-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2668-20-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2668-21-0x0000000001FF0000-0x0000000002030000-memory.dmp

Filesize
256KB

Download
memory/2668-22-0x0000000000460000-0x00000000004A2000-memory.dmp

Filesize
264KB

Download
memory/2668-23-0x0000000001FF0000-0x0000000002030000-memory.dmp

Filesize
256KB

Download
memory/2668-24-0x0000000001FF0000-0x0000000002030000-memory.dmp

Filesize
256KB

Download
memory/2668-25-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2668-26-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2668-27-0x0000000001FF0000-0x0000000002030000-memory.dmp

Filesize
256KB

Download