agenttesla | b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d

General

Target

b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe
Size

364KB
MD5

0c4bb2454ce93e6c26ced4785805455f
SHA1

597867955dfab7a5e3a30cbad3912f2a25b360f2
SHA256

b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d
SHA512

f824237372a82f2c07d1c65bc88667f091b138bb984b3b31289d2aff4e05509b01e136b78f596377c443086b0805e1d2e58e105d82ed8f1c50018e856a012363
SSDEEP

6144:P8LxB0Pi+VX4gGvnaMvFs1l5BQLUmYmcMTAPDIYsqUU6SlE4t7n6Sh0VcyqkXLTw:xwHZvGv7QL1RcEAbUc6oEOOVVnqk7Tw

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

pgqnmj.exepgqnmj.exe

pid process

2436 pgqnmj.exe
956 pgqnmj.exe
Loads dropped DLL 2 IoCs

Processes:

b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exepgqnmj.exe

pid process

2180 b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe
2436 pgqnmj.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2436	pgqnmj.exe
956	pgqnmj.exe

pid	process
2180	b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe
2436	pgqnmj.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

pgqnmj.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pgqnmj.exe
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pgqnmj.exe
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pgqnmj.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

pgqnmj.exe

description pid process target process

PID 2436 set thread context of 956 2436 pgqnmj.exe pgqnmj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pgqnmj.exe

pid process

2436 pgqnmj.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

pgqnmj.exe

description pid process

Token: SeDebugPrivilege 956 pgqnmj.exe

description	pid	process	target process
PID 2436 set thread context of 956	2436	pgqnmj.exe	pgqnmj.exe

pid	process
2436	pgqnmj.exe

description	pid	process
Token: SeDebugPrivilege	956	pgqnmj.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exepgqnmj.exe

description	pid	process	target process
PID 2180 wrote to memory of 2436	2180	b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe	pgqnmj.exe
PID 2180 wrote to memory of 2436	2180	b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe	pgqnmj.exe
PID 2180 wrote to memory of 2436	2180	b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe	pgqnmj.exe
PID 2180 wrote to memory of 2436	2180	b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe	pgqnmj.exe
PID 2436 wrote to memory of 956	2436	pgqnmj.exe	pgqnmj.exe
PID 2436 wrote to memory of 956	2436	pgqnmj.exe	pgqnmj.exe
PID 2436 wrote to memory of 956	2436	pgqnmj.exe	pgqnmj.exe
PID 2436 wrote to memory of 956	2436	pgqnmj.exe	pgqnmj.exe
PID 2436 wrote to memory of 956	2436	pgqnmj.exe	pgqnmj.exe

outlook_office_path 1 IoCs

Processes:

pgqnmj.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pgqnmj.exe

outlook_win_path 1 IoCs

Processes:

pgqnmj.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pgqnmj.exe

C:\Users\Admin\AppData\Local\Temp\b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe
"C:\Users\Admin\AppData\Local\Temp\b353f9892d8169f4e0ee5046d64ad301386ada46356f2e66e18c28ae8d17679d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\pgqnmj.exe
"C:\Users\Admin\AppData\Local\Temp\pgqnmj.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\pgqnmj.exe
"C:\Users\Admin\AppData\Local\Temp\pgqnmj.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pgqnmj.exe

Filesize
174KB

MD5
fdd06e963e6883d1f02e1e2caeabccf7

SHA1
b18a6c4a004f4c50052b10872a388ca3612b1a25

SHA256
c6cb8ecdce5278f041c56e7e5d7181087107b4c476a35e851669b2831658625e

SHA512
810a2cd90bb506ff50ba1effa833cc72a7fe9f5b9e7f8d8d8562225c200d7fc6214b5133d0d74b3b97446c8c121ca2f3b69a7b90242240dc44187336d91f2e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\pgqnmj.exe

Filesize
174KB

MD5
fdd06e963e6883d1f02e1e2caeabccf7

SHA1
b18a6c4a004f4c50052b10872a388ca3612b1a25

SHA256
c6cb8ecdce5278f041c56e7e5d7181087107b4c476a35e851669b2831658625e

SHA512
810a2cd90bb506ff50ba1effa833cc72a7fe9f5b9e7f8d8d8562225c200d7fc6214b5133d0d74b3b97446c8c121ca2f3b69a7b90242240dc44187336d91f2e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\pgqnmj.exe

Filesize
174KB

MD5
fdd06e963e6883d1f02e1e2caeabccf7

SHA1
b18a6c4a004f4c50052b10872a388ca3612b1a25

SHA256
c6cb8ecdce5278f041c56e7e5d7181087107b4c476a35e851669b2831658625e

SHA512
810a2cd90bb506ff50ba1effa833cc72a7fe9f5b9e7f8d8d8562225c200d7fc6214b5133d0d74b3b97446c8c121ca2f3b69a7b90242240dc44187336d91f2e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\tyzuvnwsyu.f

Filesize
262KB

MD5
409c870e86d7faec1b379fbbd2df418b

SHA1
94cab11508a786836a20d62e772d50d99bbd5332

SHA256
b216038ab54c08cdf8cd09f241d2ec9ac4f8596351e75d2c1e6b97dbd6662f1d

SHA512
c43ee1b4419581f619dc70e601cfb1aa16b04aceeca56f3c4ce54bac2378440ba46786e2ce155bc58bb6f49ea907f230b1e51bbdf420662cb68d247c86dd395b

Download Submit
\Users\Admin\AppData\Local\Temp\pgqnmj.exe

Filesize
174KB

MD5
fdd06e963e6883d1f02e1e2caeabccf7

SHA1
b18a6c4a004f4c50052b10872a388ca3612b1a25

SHA256
c6cb8ecdce5278f041c56e7e5d7181087107b4c476a35e851669b2831658625e

SHA512
810a2cd90bb506ff50ba1effa833cc72a7fe9f5b9e7f8d8d8562225c200d7fc6214b5133d0d74b3b97446c8c121ca2f3b69a7b90242240dc44187336d91f2e38

Download Submit
\Users\Admin\AppData\Local\Temp\pgqnmj.exe

Filesize
174KB

MD5
fdd06e963e6883d1f02e1e2caeabccf7

SHA1
b18a6c4a004f4c50052b10872a388ca3612b1a25

SHA256
c6cb8ecdce5278f041c56e7e5d7181087107b4c476a35e851669b2831658625e

SHA512
810a2cd90bb506ff50ba1effa833cc72a7fe9f5b9e7f8d8d8562225c200d7fc6214b5133d0d74b3b97446c8c121ca2f3b69a7b90242240dc44187336d91f2e38

Download Submit
memory/956-14-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/956-10-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/956-15-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/956-17-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/956-18-0x0000000004760000-0x00000000047A0000-memory.dmp

Filesize
256KB

Download
memory/956-16-0x0000000000540000-0x0000000000570000-memory.dmp

Filesize
192KB

Download
memory/956-19-0x0000000004760000-0x00000000047A0000-memory.dmp

Filesize
256KB

Download
memory/956-21-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2436-12-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2436-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads