agenttesla | 3fc20300517a9adf2ef160b4758e262accb54960aac5e431abee90e7b4b8a9eb

General

Target

c5dbb5066fdbe3b2c1070a49139fdc2a.exe
Size

874KB
MD5

c5dbb5066fdbe3b2c1070a49139fdc2a
SHA1

ff0f4dba61a1f4c2f5e1c989756a93ef370bd288
SHA256

3fc20300517a9adf2ef160b4758e262accb54960aac5e431abee90e7b4b8a9eb
SHA512

f3c104a08da6f1c6c9f1ca95d924d5138b0a6a67cfdbc5dd5098f111e287e19f963042418d0eaa2779c1d26b45b679429c5075e074a90c822bb090fee24dac37
SSDEEP

12288:P/Dg5pB+HC7lMPme7Eb88uOlMDrghzHQeXFWS/j754D9QZNv7:uBL7lMeEY88LMqlXFl4B0

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://files.000webhost.com/
Port:
21
Username:
zinco
Password:
computer147

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/1520-17-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	c5dbb5066fdbe3b2c1070a49139fdc2a.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4604 set thread context of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1520	RegSvcs.exe
1520	RegSvcs.exe
1520	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2720	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	101
PID 4604 wrote to memory of 2720	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	101
PID 4604 wrote to memory of 2720	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	101
PID 4604 wrote to memory of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103
PID 4604 wrote to memory of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103
PID 4604 wrote to memory of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103
PID 4604 wrote to memory of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103
PID 4604 wrote to memory of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103
PID 4604 wrote to memory of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103
PID 4604 wrote to memory of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103
PID 4604 wrote to memory of 1520	4604	c5dbb5066fdbe3b2c1070a49139fdc2a.exe	103

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\c5dbb5066fdbe3b2c1070a49139fdc2a.exe
"C:\Users\Admin\AppData\Local\Temp\c5dbb5066fdbe3b2c1070a49139fdc2a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dDKCdLDVegxG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF71.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEF71.tmp

Filesize
1KB

MD5
0844520f798241c2d2951f720ea1cd47

SHA1
adf0bbf52f3025b6822504fb66817182e0433953

SHA256
ef8f4b1411e4213aac9de75f801570cdbd04aad672c8ab98f4497e1b9711aa57

SHA512
c88df29e49c60b1aaf276cae844f2f213619940833900d3edd34a4855c1dca154fe3adc9557d193713fa917456f26d7036921228305becb871d60f09cf5e6657

Download Submit
memory/1520-27-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/1520-26-0x0000000006410000-0x0000000006460000-memory.dmp

Filesize
320KB

Download
memory/1520-25-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/1520-24-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/1520-23-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/1520-22-0x00000000051D0000-0x00000000051E8000-memory.dmp

Filesize
96KB

Download
memory/1520-21-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/1520-20-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/1520-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4604-5-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4604-11-0x0000000008C70000-0x0000000008CBA000-memory.dmp

Filesize
296KB

Download
memory/4604-10-0x0000000006600000-0x00000000066AE000-memory.dmp

Filesize
696KB

Download
memory/4604-9-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4604-19-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4604-8-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4604-7-0x0000000004CD0000-0x0000000004CE8000-memory.dmp

Filesize
96KB

Download
memory/4604-6-0x00000000049B0000-0x00000000049BA000-memory.dmp

Filesize
40KB

Download
memory/4604-0-0x0000000000040000-0x0000000000120000-memory.dmp

Filesize
896KB

Download
memory/4604-4-0x0000000004B00000-0x0000000004B9C000-memory.dmp

Filesize
624KB

Download
memory/4604-3-0x0000000004A60000-0x0000000004AF2000-memory.dmp

Filesize
584KB

Download
memory/4604-2-0x0000000005010000-0x00000000055B4000-memory.dmp

Filesize
5.6MB

Download
memory/4604-1-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads