agenttesla | e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485

General

Target

NEAS.e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485.exe
Size

362KB
MD5

042dad1d9bcc1a1f3b2f09626a1b193b
SHA1

3a1666c8d0c1fe2a272b03276f8679b334f6955f
SHA256

e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485
SHA512

e99e0f1af0bed42f563c6c5ec678cf4946e53fed72007757eeeea3ed3b3b18b27d7d41a47bc76fb40a74b7e144df76a707dfc6ac38f3c9ea801d0ae83bc02a0d
SSDEEP

6144:3BlL/D19uHdOE7Jox6sE0pyRxetVsS0Nzac5vVenQ4VCvNHW0OFg8sOqD:xxPu91ex6H4yOtVT0F7enQ4Mlm+3O4

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.activegroup.com.sg
Port:
587
Username:
[email protected]
Password:
active7244

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

zabqtxyqd.exezabqtxyqd.exe

pid process

2272 zabqtxyqd.exe
5016 zabqtxyqd.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2272	zabqtxyqd.exe
5016	zabqtxyqd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

zabqtxyqd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FdnCz = "C:\\Users\\Admin\\AppData\\Roaming\\FdnCz\\FdnCz.exe"	zabqtxyqd.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

32 api.ipify.org
33 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

zabqtxyqd.exe

description pid process target process

PID 2272 set thread context of 5016 2272 zabqtxyqd.exe zabqtxyqd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

zabqtxyqd.exe

pid process

5016 zabqtxyqd.exe
5016 zabqtxyqd.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

zabqtxyqd.exe

pid process

2272 zabqtxyqd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

zabqtxyqd.exe

description pid process

Token: SeDebugPrivilege 5016 zabqtxyqd.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

zabqtxyqd.exe

pid process

5016 zabqtxyqd.exe

flow	ioc
32	api.ipify.org
33	api.ipify.org

description	pid	process	target process
PID 2272 set thread context of 5016	2272	zabqtxyqd.exe	zabqtxyqd.exe

pid	process
5016	zabqtxyqd.exe
5016	zabqtxyqd.exe

pid	process
2272	zabqtxyqd.exe

description	pid	process
Token: SeDebugPrivilege	5016	zabqtxyqd.exe

pid	process
5016	zabqtxyqd.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

NEAS.e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485.exezabqtxyqd.exe

description	pid	process	target process
PID 2152 wrote to memory of 2272	2152	NEAS.e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485.exe	zabqtxyqd.exe
PID 2152 wrote to memory of 2272	2152	NEAS.e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485.exe	zabqtxyqd.exe
PID 2152 wrote to memory of 2272	2152	NEAS.e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485.exe	zabqtxyqd.exe
PID 2272 wrote to memory of 5016	2272	zabqtxyqd.exe	zabqtxyqd.exe
PID 2272 wrote to memory of 5016	2272	zabqtxyqd.exe	zabqtxyqd.exe
PID 2272 wrote to memory of 5016	2272	zabqtxyqd.exe	zabqtxyqd.exe
PID 2272 wrote to memory of 5016	2272	zabqtxyqd.exe	zabqtxyqd.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e5b79b17be3cb037a71b9468dde3a5327f0d38a3d602fa65197187eda4f76485.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152

C:\Users\Admin\AppData\Local\Temp\zabqtxyqd.exe
"C:\Users\Admin\AppData\Local\Temp\zabqtxyqd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2272

C:\Users\Admin\AppData\Local\Temp\zabqtxyqd.exe
"C:\Users\Admin\AppData\Local\Temp\zabqtxyqd.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cgbutb.zf

Filesize
334KB

MD5
dc6a0cdc45ed825a2a5f08d76ca12e3f

SHA1
9a633096874e8662ef51544dde439c1aea0dbecc

SHA256
df5b0acff1db2a8e0240c397cb5156041c667cec2af1565561f4d170f8986419

SHA512
211e0c22c1a4c55ae9b4a8b768c7fc4dcee5c4e86e1033aeb7c8c38bd02b9d79c7db75cf11c31a27b695113e6d6c8e65d36108b27cd0310b46487da87a846ff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zabqtxyqd.exe

Filesize
177KB

MD5
df16a43b03d6e57ee777e99eadcae596

SHA1
a05e53fef5d3ca5219cfcf533de329dd5621f5a8

SHA256
2177142f446cc0f571e3ac16badd47eb3da3a1d9b71fb67e0d1f716701b89eab

SHA512
296383538c8c75f92ebede27f55b0231f9cd6a5ef16dc22a59d07612d12cce374de6fadb3c096c1123730e39a931b00e6f301c24775735c6285517a57dbffcac

Download Submit
C:\Users\Admin\AppData\Local\Temp\zabqtxyqd.exe

Filesize
177KB

MD5
df16a43b03d6e57ee777e99eadcae596

SHA1
a05e53fef5d3ca5219cfcf533de329dd5621f5a8

SHA256
2177142f446cc0f571e3ac16badd47eb3da3a1d9b71fb67e0d1f716701b89eab

SHA512
296383538c8c75f92ebede27f55b0231f9cd6a5ef16dc22a59d07612d12cce374de6fadb3c096c1123730e39a931b00e6f301c24775735c6285517a57dbffcac

Download Submit
C:\Users\Admin\AppData\Local\Temp\zabqtxyqd.exe

Filesize
177KB

MD5
df16a43b03d6e57ee777e99eadcae596

SHA1
a05e53fef5d3ca5219cfcf533de329dd5621f5a8

SHA256
2177142f446cc0f571e3ac16badd47eb3da3a1d9b71fb67e0d1f716701b89eab

SHA512
296383538c8c75f92ebede27f55b0231f9cd6a5ef16dc22a59d07612d12cce374de6fadb3c096c1123730e39a931b00e6f301c24775735c6285517a57dbffcac

Download Submit
memory/2272-5-0x0000000001150000-0x0000000001152000-memory.dmp

Filesize
8KB

Download
memory/5016-12-0x00000000050D0000-0x0000000005112000-memory.dmp

Filesize
264KB

Download
memory/5016-17-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/5016-10-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5016-11-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5016-13-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/5016-7-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5016-14-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/5016-15-0x0000000005800000-0x0000000005DA4000-memory.dmp

Filesize
5.6MB

Download
memory/5016-16-0x00000000053C0000-0x0000000005426000-memory.dmp

Filesize
408KB

Download
memory/5016-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5016-18-0x00000000067C0000-0x0000000006810000-memory.dmp

Filesize
320KB

Download
memory/5016-19-0x00000000068B0000-0x000000000694C000-memory.dmp

Filesize
624KB

Download
memory/5016-20-0x00000000069F0000-0x0000000006A82000-memory.dmp

Filesize
584KB

Download
memory/5016-21-0x0000000006960000-0x000000000696A000-memory.dmp

Filesize
40KB

Download
memory/5016-22-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/5016-23-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/5016-24-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads