agenttesla | 22be2df4064414d9208f52a39a0fa6dd03b3a4ce83f8702abb901573435f8b23

General

Target

4d2e36e66c0a6b7552b97bd5034fdcbb.exe
Size

434KB
MD5

4d2e36e66c0a6b7552b97bd5034fdcbb
SHA1

9bc9f2fd6c25810ee03a0512a8e3e621c0b1e8ad
SHA256

22be2df4064414d9208f52a39a0fa6dd03b3a4ce83f8702abb901573435f8b23
SHA512

ac8a8862baa8d379bcdd153ba4963b23b1b60a4f3adef7fc107418cf9bcc81220a25bba9db69d27f8bd5ef35611419829ef9b435d39e8b78275b1fefa3b7c060
SSDEEP

6144:Oy/wN2rJ33Fx3uFDUoz3i4IqYqTmIn6jgto/uAI/7k0NNXtUaQeVVZtDw8XDFOkm:OIrFrjSi4IqYfRgtkyTdUXi3zFwVK4

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.mohhg.com
Port:
587
Username:
[email protected]
Password:
QmlgN@@qt$53

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/3940-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	4d2e36e66c0a6b7552b97bd5034fdcbb.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
Key opened	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
Key opened	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4d2e36e66c0a6b7552b97bd5034fdcbb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3092 set thread context of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
3940	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
3940	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
3940	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
3940	4d2e36e66c0a6b7552b97bd5034fdcbb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe
Token: SeDebugPrivilege	3940	4d2e36e66c0a6b7552b97bd5034fdcbb.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 3964	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	104
PID 3092 wrote to memory of 3964	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	104
PID 3092 wrote to memory of 3964	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	104
PID 3092 wrote to memory of 1424	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	106
PID 3092 wrote to memory of 1424	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	106
PID 3092 wrote to memory of 1424	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	106
PID 3092 wrote to memory of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107
PID 3092 wrote to memory of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107
PID 3092 wrote to memory of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107
PID 3092 wrote to memory of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107
PID 3092 wrote to memory of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107
PID 3092 wrote to memory of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107
PID 3092 wrote to memory of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107
PID 3092 wrote to memory of 3940	3092	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4d2e36e66c0a6b7552b97bd5034fdcbb.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4d2e36e66c0a6b7552b97bd5034fdcbb.exe

C:\Users\Admin\AppData\Local\Temp\4d2e36e66c0a6b7552b97bd5034fdcbb.exe
"C:\Users\Admin\AppData\Local\Temp\4d2e36e66c0a6b7552b97bd5034fdcbb.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NNBvRA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp17AA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3964
- C:\Users\Admin\AppData\Local\Temp\4d2e36e66c0a6b7552b97bd5034fdcbb.exe
  "{path}"
  2⤵
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\4d2e36e66c0a6b7552b97bd5034fdcbb.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\4d2e36e66c0a6b7552b97bd5034fdcbb.exe.log

Filesize
496B

MD5
63f1e06722ac68818d178a5f31223361

SHA1
5277a57b1eefc420257956ace54a3792443be6ac

SHA256
30171a07044d823e8129df3a3ce52f22493b27fe15468593dd461f41d10fac63

SHA512
3ff602b636a0b537a872e141b1e5a31cfece8fba454c5279c68a90ab9940625b63768af4b9cd185da6b8505e457839b7432416d62c85d2136ddd14a27e3c6fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp17AA.tmp

Filesize
1KB

MD5
8e4e7d1b2530c142ba3dca90c4a7717f

SHA1
ea232999552846a5ef5afcb22599c17027bb35f3

SHA256
481f509283c3225c0985a51d1fc9a087487a92fd724a43e3a991d1a510545a53

SHA512
4f59db182846d5071467f9d7ceb9015d2a0afe3629c6101a99010b3418b44fd70be5a48f14a1c41896d0bec96398cc87bd8727df511ee57925c628305409efda

Download Submit
memory/3092-12-0x0000000075550000-0x0000000075B01000-memory.dmp

Filesize
5.7MB

Download
memory/3092-0-0x0000000075550000-0x0000000075B01000-memory.dmp

Filesize
5.7MB

Download
memory/3092-4-0x00000000018C0000-0x00000000018D0000-memory.dmp

Filesize
64KB

Download
memory/3092-2-0x00000000018C0000-0x00000000018D0000-memory.dmp

Filesize
64KB

Download
memory/3092-3-0x0000000075550000-0x0000000075B01000-memory.dmp

Filesize
5.7MB

Download
memory/3092-1-0x0000000075550000-0x0000000075B01000-memory.dmp

Filesize
5.7MB

Download
memory/3940-11-0x0000000075550000-0x0000000075B01000-memory.dmp

Filesize
5.7MB

Download
memory/3940-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3940-13-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/3940-14-0x0000000075550000-0x0000000075B01000-memory.dmp

Filesize
5.7MB

Download
memory/3940-15-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/3940-16-0x0000000075550000-0x0000000075B01000-memory.dmp

Filesize
5.7MB

Download
memory/3940-17-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/3940-18-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/3940-19-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads