agenttesla | abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b

General

Target

abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b.exe
Size

234KB
MD5

d2cf87fc4a4bc0ff01acaf88325d9c9a
SHA1

2684a9393b879c524403ef126dda1dc5ddf6befe
SHA256

abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b
SHA512

69f44577fcf46314a5326ca732a55f012700d338697eee677d9eed04fe07c6003005649c75c6cc0bd7cff331da7991df5a8fddd51a07a45963f257e4fdc7559b
SSDEEP

3072:H9JlxVZCHuUD09bVS36kDTU5SNx2Kh+r5ckLo69:H9JlxVZCHuUD09bVSJTUQN8Kh+DLz

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail5.planetc.net
Port:
587
Username:
[email protected]
Password:
623434@esit

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail5.planetc.net
Port:
587
Username:
[email protected]
Password:
623434@esit
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8	abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\Blob = 03000000010000001400000027ac9369faf25207bb2627cefaccbe4ef9c319b814000000010000001400000040c2bd278ecc348330a233d7fb6cb3f0b42c80ce04000000010000001000000096c25031bc0dc35cfba723731e1b41400f0000000100000020000000f9ff37f02e632cb7387025c07e57908a3d371b7c95d8cdd0390de231ed943a12190000000100000010000000ce63bdc595635c1c37b040b4e554bf565c00000001000000040000000008000018000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000d4040000308204d0308203b8a003020102020107300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3131303530333037303030305a170d3331303530333037303030305a3081b4310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e312d302b060355040b1324687474703a2f2f63657274732e676f64616464792e636f6d2f7265706f7369746f72792f313330310603550403132a476f2044616464792053656375726520436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100b9e0cb10d4af76bdd49362eb3064b881086cc304d962178e2fff3e65cf8fce62e63c521cda16454b55ab786b63836290ce0f696c99c81a148b4ccc4533ea88dc9ea3af2bfe80619d7957c4cf2ef43f303c5d47fc9a16bcc3379641518e114b54f828bed08cbef030381ef3b026f86647636dde7126478f384753d1461db4e3dc00ea45acbdbc71d9aa6f00dbdbcd303a794f5f4c47f81def5bc2c49d603bb1b24391d8a4334eeab3d6274fad258aa5c6f4d5d0a6ae7405645788b54455d42d2a3a3ef8b8bde9320a029464c4163a50f14aaee77933af0c20077fe8df0439c269026c6352fa77c11bc87487c8b993185054354b694ebc3bd3492e1fdcc1d252fb0203010001a382011a30820116300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041440c2bd278ecc348330a233d7fb6cb3f0b42c80ce301f0603551d230418301680143a9a8507106728b6eff6bd05416e20c194da0fde303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e676f64616464792e636f6d2f30350603551d1f042e302c302aa028a0268624687474703a2f2f63726c2e676f64616464792e636f6d2f6764726f6f742d67322e63726c30460603551d20043f303d303b0604551d20003033303106082b06010505070201162568747470733a2f2f63657274732e676f64616464792e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010b05000382010100087e6c9310c838b896a9904bffa15f4f04ef6c3e9c8806c9508fa673f757311bbebce42fdbf8bad35be0b4e7e679620e0ca2d76a637331b5f5a848a43b082da25d90d7b47c254f115630c4b6449d7b2c9de55ee6ef0c61aabfe42a1bee849eb8837dc143ce44a713700d911ff4c813ad8360d9d872a873241eb5ac220eca17896258441bab892501000fcdc41b62db51b4d30f512a9bf4bc73fc76ce36a4cdd9d82ceaae9bf52ab290d14d75188a3f8a4190237d5b4bfea403589b46b2c3606083f87d5041cec2a190c3bbef022fd21554ee4415d90aaea78a33edb12d763626dc04eb9ff7611f15dc876fee469628ada1267d0a09a72e04a38dbcf8bc043001	abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b.exe
2920	abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b.exe

C:\Users\Admin\AppData\Local\Temp\abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b.exe
"C:\Users\Admin\AppData\Local\Temp\abe25fed306527cc8ba4abc95c3afd722952494f0c4fb64577375dcd6c01dd2b.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2920-0-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download
memory/2920-1-0x0000000000F40000-0x0000000000F80000-memory.dmp

Filesize
256KB

Download
memory/2920-2-0x0000000005EF0000-0x0000000006494000-memory.dmp

Filesize
5.6MB

Download
memory/2920-3-0x0000000005B10000-0x0000000005B20000-memory.dmp

Filesize
64KB

Download
memory/2920-4-0x0000000005B20000-0x0000000005B86000-memory.dmp

Filesize
408KB

Download
memory/2920-5-0x0000000007260000-0x00000000072B0000-memory.dmp

Filesize
320KB

Download
memory/2920-6-0x0000000007350000-0x00000000073EC000-memory.dmp

Filesize
624KB

Download
memory/2920-11-0x0000000007920000-0x00000000079B2000-memory.dmp

Filesize
584KB

Download
memory/2920-12-0x00000000074E0000-0x00000000074EA000-memory.dmp

Filesize
40KB

Download
memory/2920-13-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download
memory/2920-14-0x0000000005B10000-0x0000000005B20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads