agenttesla | 8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976

General

Target

8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976.exe
Size

587KB
MD5

ce62a9d0c996178c2ac6a7b9a652257e
SHA1

a8b4df6d25572780e70d10f64a5f7cda95180bd4
SHA256

8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976
SHA512

a9cebf2750e1da9cae45825212c2189fe25cb6194c0b2ca564185f44514ba71f01adc9e6181acd56c8b355e2ebe6f0d34a133fed9e7af1b8f7fa3ba88a8d0520
SSDEEP

12288:KxPgUrz/QxsOiVSXGNmMyR+llVu07GOjmnmvHV:qh4ZiVS2NmIuO4mvV

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
premium185.web-hosting.com
Port:
587
Username:
[email protected]
Password:
cooldown2013

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

tmtuht.exetmtuht.exe

pid process

2424 tmtuht.exe
3104 tmtuht.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2424	tmtuht.exe
3104	tmtuht.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tmtuht.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SzvWIzD = "C:\\Users\\Admin\\AppData\\Roaming\\SzvWIzD\\SzvWIzD.exe"	tmtuht.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

30 api.ipify.org
32 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmtuht.exe

description pid process target process

PID 2424 set thread context of 3104 2424 tmtuht.exe tmtuht.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

tmtuht.exe

pid process

3104 tmtuht.exe
3104 tmtuht.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

tmtuht.exe

pid process

2424 tmtuht.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmtuht.exe

description pid process

Token: SeDebugPrivilege 3104 tmtuht.exe

flow	ioc
30	api.ipify.org
32	api.ipify.org

description	pid	process	target process
PID 2424 set thread context of 3104	2424	tmtuht.exe	tmtuht.exe

pid	process
3104	tmtuht.exe
3104	tmtuht.exe

pid	process
2424	tmtuht.exe

description	pid	process
Token: SeDebugPrivilege	3104	tmtuht.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976.exetmtuht.exe

description	pid	process	target process
PID 3980 wrote to memory of 2424	3980	8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976.exe	tmtuht.exe
PID 3980 wrote to memory of 2424	3980	8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976.exe	tmtuht.exe
PID 3980 wrote to memory of 2424	3980	8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976.exe	tmtuht.exe
PID 2424 wrote to memory of 3104	2424	tmtuht.exe	tmtuht.exe
PID 2424 wrote to memory of 3104	2424	tmtuht.exe	tmtuht.exe
PID 2424 wrote to memory of 3104	2424	tmtuht.exe	tmtuht.exe
PID 2424 wrote to memory of 3104	2424	tmtuht.exe	tmtuht.exe

C:\Users\Admin\AppData\Local\Temp\8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976.exe
"C:\Users\Admin\AppData\Local\Temp\8443db8f13ee9852c43c33605e22104d3ea320276f2affff0534627076c52976.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Users\Admin\AppData\Local\Temp\tmtuht.exe
"C:\Users\Admin\AppData\Local\Temp\tmtuht.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2424

C:\Users\Admin\AppData\Local\Temp\tmtuht.exe
"C:\Users\Admin\AppData\Local\Temp\tmtuht.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tiilk.u

Filesize
333KB

MD5
b984c359bab693eb3c6c133db0777c37

SHA1
ba8a80bb8cf2495a5714a8b9d4e215e3f136a276

SHA256
0731011a5247799b0b016b1bdde41d635f8475251063dc1300de3bbbe93cc2a6

SHA512
259958da5b33a49c6f54608b37d8b163c8aa6dc02081ff2b2edc9ac01fa97c963bed0d95360ac4a9a5cb6d78c46243e360d5ef589b54409520f5a89e991eac66

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmtuht.exe

Filesize
165KB

MD5
01510af00c29e6f934350883c257a786

SHA1
ca506e7993ec5c526525d3aa99f688431a337225

SHA256
a8ca422e55514a9e08501f028abce1039b23e50836a97cde34b8508cebc20a91

SHA512
a14c18607235c4166ec2349c6fca741deaf4cd9591ce216d77f96d69c5d0a2638937932a2dc04874972845545a27250dded00a411a045bc1d1a540adce70d41f

Download Submit
memory/2424-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2424-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3104-15-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/3104-18-0x0000000005110000-0x0000000005176000-memory.dmp

Filesize
408KB

Download
memory/3104-7-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3104-12-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3104-14-0x0000000073F70000-0x0000000074720000-memory.dmp

Filesize
7.7MB

Download
memory/3104-13-0x0000000004920000-0x0000000004962000-memory.dmp

Filesize
264KB

Download
memory/3104-9-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3104-16-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/3104-17-0x00000000049C0000-0x0000000004F64000-memory.dmp

Filesize
5.6MB

Download
memory/3104-10-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3104-19-0x0000000005FA0000-0x0000000005FF0000-memory.dmp

Filesize
320KB

Download
memory/3104-20-0x0000000005FF0000-0x000000000608C000-memory.dmp

Filesize
624KB

Download
memory/3104-22-0x0000000006140000-0x00000000061D2000-memory.dmp

Filesize
584KB

Download
memory/3104-23-0x0000000006250000-0x000000000625A000-memory.dmp

Filesize
40KB

Download
memory/3104-24-0x0000000073F70000-0x0000000074720000-memory.dmp

Filesize
7.7MB

Download
memory/3104-25-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/3104-27-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/3104-28-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads