agenttesla | 97252ce52f0d5e32b8e73b8f224539d8eb04dcf7d4ce92e84deccad49656aebd

General

Target

Copy#0700181203.exe
Size

307KB
MD5

3a7ad7df17d52faa30c9267d8993c052
SHA1

20babf125ffdc301bc7670817f8123af61ff0940
SHA256

a3d1e36ffb22746489c9932108842ef58d71c86c5a01bade59d1f0f9cbe2fde4
SHA512

6d7d7ea7a3310c7cc768556126f710d21f2dc500c5287613a35ba020a0b0ec5f85101c27068c2dc4ef94135e6228aec7501ceba123ebbd81891467ebfa37cbb8
SSDEEP

3072:qvBGLqxexlS+I3lPE6MPYUNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbGgKk12g:qvwpkqBstvLGtELbMUTKZIH

Score

10^/10

agenttesla xworm zgrat keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

94.156.65.181:5353

Mutex

4EV9DEZhSiEuj72Q

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2760-4911-0x0000000000400000-0x000000000044A000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\FB_AFA1.tmp.exe	family_xworm
behavioral1/memory/1712-4925-0x00000000013B0000-0x00000000013C0000-memory.dmp	family_xworm

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2080-3-0x0000000008770000-0x00000000089A6000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-5-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-9-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-11-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-15-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-13-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-17-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-23-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-25-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-21-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-19-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-7-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-4-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-27-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-39-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-41-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-49-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-59-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-67-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-57-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-65-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-63-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-62-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-55-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-53-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-51-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-47-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-45-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-43-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-37-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-35-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-33-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-31-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2080-29-0x0000000008770000-0x00000000089A0000-memory.dmp	family_zgrat_v1

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 2 IoCs

Processes:

FB_AF52.tmp.exeFB_AFA1.tmp.exe

pid process

2012 FB_AF52.tmp.exe
1712 FB_AFA1.tmp.exe
Loads dropped DLL 2 IoCs

Processes:

RegAsm.exe

pid process

2760 RegAsm.exe
2760 RegAsm.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2012	FB_AF52.tmp.exe
1712	FB_AFA1.tmp.exe

pid	process
2760	RegAsm.exe
2760	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Copy#0700181203.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\savef = "C:\\Users\\Admin\\AppData\\Roaming\\savef.exe"	Copy#0700181203.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
7 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Copy#0700181203.exe

description pid process target process

PID 2080 set thread context of 2760 2080 Copy#0700181203.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

FB_AFA1.tmp.exe

pid process

1712 FB_AFA1.tmp.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

FB_AF52.tmp.exeFB_AFA1.tmp.exe

pid process

2012 FB_AF52.tmp.exe
2012 FB_AF52.tmp.exe
1712 FB_AFA1.tmp.exe

flow	ioc
6	api.ipify.org
7	api.ipify.org

description	pid	process	target process
PID 2080 set thread context of 2760	2080	Copy#0700181203.exe	RegAsm.exe

pid	process
1712	FB_AFA1.tmp.exe

pid	process
2012	FB_AF52.tmp.exe
2012	FB_AF52.tmp.exe
1712	FB_AFA1.tmp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Copy#0700181203.exeFB_AF52.tmp.exeFB_AFA1.tmp.exe

description	pid	process
Token: SeDebugPrivilege	2080	Copy#0700181203.exe
Token: SeDebugPrivilege	2080	Copy#0700181203.exe
Token: SeDebugPrivilege	2012	FB_AF52.tmp.exe
Token: SeDebugPrivilege	1712	FB_AFA1.tmp.exe
Token: SeDebugPrivilege	1712	FB_AFA1.tmp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

FB_AFA1.tmp.exe

pid process

1712 FB_AFA1.tmp.exe

pid	process
1712	FB_AFA1.tmp.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Copy#0700181203.exeRegAsm.exe

description	pid	process	target process
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2080 wrote to memory of 2760	2080	Copy#0700181203.exe	RegAsm.exe
PID 2760 wrote to memory of 2012	2760	RegAsm.exe	FB_AF52.tmp.exe
PID 2760 wrote to memory of 2012	2760	RegAsm.exe	FB_AF52.tmp.exe
PID 2760 wrote to memory of 2012	2760	RegAsm.exe	FB_AF52.tmp.exe
PID 2760 wrote to memory of 2012	2760	RegAsm.exe	FB_AF52.tmp.exe
PID 2760 wrote to memory of 1712	2760	RegAsm.exe	FB_AFA1.tmp.exe
PID 2760 wrote to memory of 1712	2760	RegAsm.exe	FB_AFA1.tmp.exe
PID 2760 wrote to memory of 1712	2760	RegAsm.exe	FB_AFA1.tmp.exe
PID 2760 wrote to memory of 1712	2760	RegAsm.exe	FB_AFA1.tmp.exe

C:\Users\Admin\AppData\Local\Temp\Copy#0700181203.exe
"C:\Users\Admin\AppData\Local\Temp\Copy#0700181203.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760

C:\Users\Admin\AppData\Local\Temp\FB_AF52.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_AF52.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Users\Admin\AppData\Local\Temp\FB_AFA1.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_AFA1.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FB_AF52.tmp.exe
Filesize
234KB

MD5
06db36296ae61e019a6c6e717c94767b

SHA1
7a00c1ada2ad8ed153488ba9a761b76b94716cd2

SHA256
e3806f66f45cd3ab049bd762b7cb14c2c27ca7854221356d7681c239c510b3ab

SHA512
0db22d6c5ab97e827994b4998c7ac717b7421ce15c40eae6ec4d082df51232434cb408179268b9bc82ed4218c3c46dd79273f14071b692e2e412b6aa637b73ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_AFA1.tmp.exe
Filesize
41KB

MD5
f334a1ac079415859e447dfe9581fcdb

SHA1
6c906d05d4fd5ca52c4661abd2a6ca00446a6d7d

SHA256
dc794a76f3d4644853d105b86586700c24d36c4bf0b13582209d22f651fa18f9

SHA512
bf9bf1317845f1e48ad31b138ca70dd8bd4b5acb96a01a3639adbe186b369a3c15bf4609ff79f8996b89158ac95986e26ecbbd40216e2a8e12b56457a949343d

Download Submit
memory/1712-4925-0x00000000013B0000-0x00000000013C0000-memory.dmp

Filesize
64KB

Download
memory/2012-4923-0x0000000000090000-0x00000000000D0000-memory.dmp

Filesize
256KB

Download
memory/2080-59-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-4910-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-2-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-3-0x0000000008770000-0x00000000089A6000-memory.dmp

Filesize
2.2MB

Download
memory/2080-5-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-9-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-11-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-15-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-13-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-17-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-23-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-25-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-21-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-19-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-7-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-4-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-57-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-39-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-41-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-49-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-0-0x000000007496E000-0x000000007496F000-memory.dmp

Filesize
4KB

Download
memory/2080-67-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-63-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-1-0x0000000000070000-0x00000000000C0000-memory.dmp

Filesize
320KB

Download
memory/2080-27-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-62-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-55-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-53-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-4884-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-51-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-47-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-45-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-43-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-37-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-4886-0x0000000005510000-0x000000000555C000-memory.dmp

Filesize
304KB

Download
memory/2080-4885-0x0000000004C70000-0x0000000004CE2000-memory.dmp

Filesize
456KB

Download
memory/2080-35-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-33-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-31-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-29-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2080-4887-0x000000007496E000-0x000000007496F000-memory.dmp

Filesize
4KB

Download
memory/2080-4888-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-4889-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-4890-0x0000000004BB0000-0x0000000004C04000-memory.dmp

Filesize
336KB

Download
memory/2080-65-0x0000000008770000-0x00000000089A0000-memory.dmp

Filesize
2.2MB

Download
memory/2760-4911-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads