agenttesla | a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3

General

Target

a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe
Size

406KB
MD5

bd36049cff41be20392da7c3d5279b98
SHA1

cd3f09d3273d60aa03a127e99f37c1c73b086e97
SHA256

a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3
SHA512

1174e503416ca3d0fc0711c1eb68e53249600cbf52d5b5e9b53448c9bd266edd9e5bb998ee975b24341e0fc577445d40868dfb44dbcd77b66eb4f5f4f43073d0
SSDEEP

12288:Dn0SBro//EWZys11TLMKrLqfhkQHf4e7Kj:DNro/ckNzPMyqfhz4e7a

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2812	mzhxcbw.exe
3032	mzhxcbw.exe

Loads dropped DLL 3 IoCs

pid	Process
2932	a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe
2932	a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe
2812	mzhxcbw.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\LHdEfz = "C:\\Users\\Admin\\AppData\\Roaming\\LHdEfz\\LHdEfz.exe"	mzhxcbw.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 3032	2812	mzhxcbw.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3032	mzhxcbw.exe
3032	mzhxcbw.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2812	mzhxcbw.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	mzhxcbw.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	mzhxcbw.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2812	2932	a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe	28
PID 2932 wrote to memory of 2812	2932	a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe	28
PID 2932 wrote to memory of 2812	2932	a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe	28
PID 2932 wrote to memory of 2812	2932	a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe	28
PID 2812 wrote to memory of 3032	2812	mzhxcbw.exe	29
PID 2812 wrote to memory of 3032	2812	mzhxcbw.exe	29
PID 2812 wrote to memory of 3032	2812	mzhxcbw.exe	29
PID 2812 wrote to memory of 3032	2812	mzhxcbw.exe	29
PID 2812 wrote to memory of 3032	2812	mzhxcbw.exe	29

C:\Users\Admin\AppData\Local\Temp\a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe
"C:\Users\Admin\AppData\Local\Temp\a9820550522d6a148ac068caf435027f2a9c7480021b8f54730aba998e28ffd3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\mzhxcbw.exe
  "C:\Users\Admin\AppData\Local\Temp\mzhxcbw.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\mzhxcbw.exe
    "C:\Users\Admin\AppData\Local\Temp\mzhxcbw.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mzhxcbw.exe

Filesize
167KB

MD5
70a1ce678280758e42b3ec7018648bce

SHA1
40de991e1b7eea6919f34c6b0d3af44d04d0a8bb

SHA256
2886fd36add64512255f48a6890e07873b4cb9a26810b0ff4ff4edfdf1446cb3

SHA512
a3ed8647c6fcc9427b0777e802a3b495c118785092b8b7dda56b5f6de3f6168c8b9d6a0886e304fcae314c15c905be61ce5f382ed8cdacc2d650db3222517383

Download Submit
C:\Users\Admin\AppData\Local\Temp\mzhxcbw.exe

Filesize
167KB

MD5
70a1ce678280758e42b3ec7018648bce

SHA1
40de991e1b7eea6919f34c6b0d3af44d04d0a8bb

SHA256
2886fd36add64512255f48a6890e07873b4cb9a26810b0ff4ff4edfdf1446cb3

SHA512
a3ed8647c6fcc9427b0777e802a3b495c118785092b8b7dda56b5f6de3f6168c8b9d6a0886e304fcae314c15c905be61ce5f382ed8cdacc2d650db3222517383

Download Submit
C:\Users\Admin\AppData\Local\Temp\mzhxcbw.exe

Filesize
167KB

MD5
70a1ce678280758e42b3ec7018648bce

SHA1
40de991e1b7eea6919f34c6b0d3af44d04d0a8bb

SHA256
2886fd36add64512255f48a6890e07873b4cb9a26810b0ff4ff4edfdf1446cb3

SHA512
a3ed8647c6fcc9427b0777e802a3b495c118785092b8b7dda56b5f6de3f6168c8b9d6a0886e304fcae314c15c905be61ce5f382ed8cdacc2d650db3222517383

Download Submit
C:\Users\Admin\AppData\Local\Temp\mzhxcbw.exe

Filesize
167KB

MD5
70a1ce678280758e42b3ec7018648bce

SHA1
40de991e1b7eea6919f34c6b0d3af44d04d0a8bb

SHA256
2886fd36add64512255f48a6890e07873b4cb9a26810b0ff4ff4edfdf1446cb3

SHA512
a3ed8647c6fcc9427b0777e802a3b495c118785092b8b7dda56b5f6de3f6168c8b9d6a0886e304fcae314c15c905be61ce5f382ed8cdacc2d650db3222517383

Download Submit
C:\Users\Admin\AppData\Local\Temp\wdtqoi.vvu

Filesize
335KB

MD5
f1599514ab1aa9828f2b6889e1b10ac6

SHA1
787c41364405afd05d17dc0c8ac406a4c6ca205f

SHA256
3aea5bece72ee8e233cc492d6d972ddba1cc53048a7e8df6b4c2769d156a68ea

SHA512
5f26fda538e8fe3c9e957a587becb753d3127e1233c3fcc9372cb18924bffbdce28a4ca79dd7e6aa82eaabeb9a371a7e966898ee2b42c48a273f328baabde822

Download Submit
\Users\Admin\AppData\Local\Temp\mzhxcbw.exe

Filesize
167KB

MD5
70a1ce678280758e42b3ec7018648bce

SHA1
40de991e1b7eea6919f34c6b0d3af44d04d0a8bb

SHA256
2886fd36add64512255f48a6890e07873b4cb9a26810b0ff4ff4edfdf1446cb3

SHA512
a3ed8647c6fcc9427b0777e802a3b495c118785092b8b7dda56b5f6de3f6168c8b9d6a0886e304fcae314c15c905be61ce5f382ed8cdacc2d650db3222517383

Download Submit
\Users\Admin\AppData\Local\Temp\mzhxcbw.exe

Filesize
167KB

MD5
70a1ce678280758e42b3ec7018648bce

SHA1
40de991e1b7eea6919f34c6b0d3af44d04d0a8bb

SHA256
2886fd36add64512255f48a6890e07873b4cb9a26810b0ff4ff4edfdf1446cb3

SHA512
a3ed8647c6fcc9427b0777e802a3b495c118785092b8b7dda56b5f6de3f6168c8b9d6a0886e304fcae314c15c905be61ce5f382ed8cdacc2d650db3222517383

Download Submit
\Users\Admin\AppData\Local\Temp\mzhxcbw.exe

Filesize
167KB

MD5
70a1ce678280758e42b3ec7018648bce

SHA1
40de991e1b7eea6919f34c6b0d3af44d04d0a8bb

SHA256
2886fd36add64512255f48a6890e07873b4cb9a26810b0ff4ff4edfdf1446cb3

SHA512
a3ed8647c6fcc9427b0777e802a3b495c118785092b8b7dda56b5f6de3f6168c8b9d6a0886e304fcae314c15c905be61ce5f382ed8cdacc2d650db3222517383

Download Submit
memory/2812-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2812-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3032-13-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3032-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3032-18-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3032-20-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/3032-19-0x0000000001CF0000-0x0000000001D32000-memory.dmp

Filesize
264KB

Download
memory/3032-21-0x0000000001D40000-0x0000000001D80000-memory.dmp

Filesize
256KB

Download
memory/3032-22-0x0000000001D40000-0x0000000001D80000-memory.dmp

Filesize
256KB

Download
memory/3032-24-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads