agenttesla | 6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb

General

Target

6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb.exe
Size

589KB
MD5

78c5bac4dfa513cf39fb0d44435017f3
SHA1

7bd2cca71ec164a85a10fb849591b438ff54712d
SHA256

6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb
SHA512

d68c38301bae5b03346c45ef361ffc709a8762befa979688a609660f0ce881d36157a9a839092114ee2c5179c5bd0387a384e78ae57cbf3ac424c58acdf6a33e
SSDEEP

12288:qxPgUr7QA+SRIHj5TCkvibt3oXuWtTrzKD:KxASA97vk4+WprWD

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
premium185.web-hosting.com
Port:
587
Username:
[email protected]
Password:
cooldown2013

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

mcqxuzyyi.exemcqxuzyyi.exe

pid process

2516 mcqxuzyyi.exe
3904 mcqxuzyyi.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2516	mcqxuzyyi.exe
3904	mcqxuzyyi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mcqxuzyyi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SzvWIzD = "C:\\Users\\Admin\\AppData\\Roaming\\SzvWIzD\\SzvWIzD.exe"	mcqxuzyyi.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

38 api.ipify.org
39 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

mcqxuzyyi.exe

description pid process target process

PID 2516 set thread context of 3904 2516 mcqxuzyyi.exe mcqxuzyyi.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

mcqxuzyyi.exe

pid process

3904 mcqxuzyyi.exe
3904 mcqxuzyyi.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

mcqxuzyyi.exe

pid process

2516 mcqxuzyyi.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mcqxuzyyi.exe

description pid process

Token: SeDebugPrivilege 3904 mcqxuzyyi.exe

flow	ioc
38	api.ipify.org
39	api.ipify.org

description	pid	process	target process
PID 2516 set thread context of 3904	2516	mcqxuzyyi.exe	mcqxuzyyi.exe

pid	process
3904	mcqxuzyyi.exe
3904	mcqxuzyyi.exe

pid	process
2516	mcqxuzyyi.exe

description	pid	process
Token: SeDebugPrivilege	3904	mcqxuzyyi.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb.exemcqxuzyyi.exe

description	pid	process	target process
PID 2336 wrote to memory of 2516	2336	6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb.exe	mcqxuzyyi.exe
PID 2336 wrote to memory of 2516	2336	6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb.exe	mcqxuzyyi.exe
PID 2336 wrote to memory of 2516	2336	6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb.exe	mcqxuzyyi.exe
PID 2516 wrote to memory of 3904	2516	mcqxuzyyi.exe	mcqxuzyyi.exe
PID 2516 wrote to memory of 3904	2516	mcqxuzyyi.exe	mcqxuzyyi.exe
PID 2516 wrote to memory of 3904	2516	mcqxuzyyi.exe	mcqxuzyyi.exe
PID 2516 wrote to memory of 3904	2516	mcqxuzyyi.exe	mcqxuzyyi.exe

C:\Users\Admin\AppData\Local\Temp\6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb.exe
"C:\Users\Admin\AppData\Local\Temp\6fcecfa549267bc93d3e1171a20d85f6f52b5350234e7a876ac37a21235058fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\AppData\Local\Temp\mcqxuzyyi.exe
"C:\Users\Admin\AppData\Local\Temp\mcqxuzyyi.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2516

C:\Users\Admin\AppData\Local\Temp\mcqxuzyyi.exe
"C:\Users\Admin\AppData\Local\Temp\mcqxuzyyi.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dxbdsw.na

Filesize
333KB

MD5
684dc0baaea05e908db699edbca33579

SHA1
2f006dd01354570e50194348c9227cb72e19ab33

SHA256
2a31688c9ebc21e8e8a92dc9c053a453ae328fc2aa59c7bf548395aba2c3ca06

SHA512
a4236bb46850dd0a22fb9888c377e87b0904336117c3ce9baccd7519ad488fedb0c18e2065d442b225f41bd750bce6a926071bcdd2a53e43f629e1c9966f903d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mcqxuzyyi.exe

Filesize
165KB

MD5
212543780377fca0c3edea84f0b00507

SHA1
da9568e59bac0b31ded63232dade7433b2b6b6b9

SHA256
00ad057e6801a9c96b671792d93ecbe413d58662445971c514171936910ef447

SHA512
a846f042a49a886da20b8c4aa23a305a3037f6a57330f5b76dd995a9e1c1dd514881ee665515512956d763e65654f3f1a37b4deef2756843277336bf03f8fde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\mcqxuzyyi.exe

Filesize
165KB

MD5
212543780377fca0c3edea84f0b00507

SHA1
da9568e59bac0b31ded63232dade7433b2b6b6b9

SHA256
00ad057e6801a9c96b671792d93ecbe413d58662445971c514171936910ef447

SHA512
a846f042a49a886da20b8c4aa23a305a3037f6a57330f5b76dd995a9e1c1dd514881ee665515512956d763e65654f3f1a37b4deef2756843277336bf03f8fde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\mcqxuzyyi.exe

Filesize
165KB

MD5
212543780377fca0c3edea84f0b00507

SHA1
da9568e59bac0b31ded63232dade7433b2b6b6b9

SHA256
00ad057e6801a9c96b671792d93ecbe413d58662445971c514171936910ef447

SHA512
a846f042a49a886da20b8c4aa23a305a3037f6a57330f5b76dd995a9e1c1dd514881ee665515512956d763e65654f3f1a37b4deef2756843277336bf03f8fde6

Download Submit
memory/2516-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2516-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3904-13-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/3904-17-0x0000000005110000-0x0000000005176000-memory.dmp

Filesize
408KB

Download
memory/3904-11-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3904-12-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3904-15-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/3904-14-0x0000000002420000-0x0000000002462000-memory.dmp

Filesize
264KB

Download
memory/3904-7-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3904-16-0x00000000049B0000-0x0000000004F54000-memory.dmp

Filesize
5.6MB

Download
memory/3904-18-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/3904-9-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3904-19-0x0000000005FA0000-0x0000000005FF0000-memory.dmp

Filesize
320KB

Download
memory/3904-20-0x0000000005FF0000-0x000000000608C000-memory.dmp

Filesize
624KB

Download
memory/3904-21-0x0000000006140000-0x00000000061D2000-memory.dmp

Filesize
584KB

Download
memory/3904-22-0x0000000006350000-0x000000000635A000-memory.dmp

Filesize
40KB

Download
memory/3904-24-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/3904-26-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/3904-27-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/3904-28-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/3904-29-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads