agenttesla | 6a33fd9b1812a319e10fb337b87baabf2f90ae938b9bb1d0bed94c70b7cc2423

General

Target

ITEMS CATOLOG SLIDE.exe
Size

937KB
MD5

4a323d354ce4f623d28481674820af27
SHA1

47c96244f4f6c5ba61b09d97694afbf16707cff8
SHA256

9a40bb86b69f6c6702f4cef6b9b4c51c68d5923a239eaf6ed3029374d13ccee8
SHA512

2f5cec2c419460af012bfc233222db3ba7ba64c2339ac4c2f6dca17377c7cdf4f0cfa4fbec47577f35fcbeee728724483d5e98357681261a9a7cb7675a89fcb3
SSDEEP

12288:PMMbni72U8L4042zQ1WVeXFfJoPQ59ouW1md0PaLAJRCIYpu5ssoxJzNJbH7o:kMbni723L73/gXFxoYzcBVeNN7o

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.avtorska.com.mk
Port:
587
Username:
[email protected]
Password:
avtorska2014@

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.avtorska.com.mk
Port:
587
Username:
[email protected]
Password:
avtorska2014@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 1 IoCs

Processes:

file.exe

pid process

4404 file.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4404	file.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exeRegAsm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\files = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\mail\\file.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skype.exe"	RegAsm.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

53 api.ipify.org
54 api.ipify.org
55 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 4404 set thread context of 760 4404 file.exe RegAsm.exe
Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

3400 PING.EXE
2152 PING.EXE
3020 PING.EXE

flow	ioc
53	api.ipify.org
54	api.ipify.org
55	ip-api.com

description	pid	process	target process
PID 4404 set thread context of 760	4404	file.exe	RegAsm.exe

pid	process
3400	PING.EXE
2152	PING.EXE
3020	PING.EXE

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

ITEMS CATOLOG SLIDE.exefile.exeRegAsm.exe

pid	process
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
1372	ITEMS CATOLOG SLIDE.exe
4404	file.exe
4404	file.exe
4404	file.exe
4404	file.exe
760	RegAsm.exe
760	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ITEMS CATOLOG SLIDE.exefile.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 1372 ITEMS CATOLOG SLIDE.exe
Token: SeDebugPrivilege 4404 file.exe
Token: SeDebugPrivilege 760 RegAsm.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

760 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1372	ITEMS CATOLOG SLIDE.exe
Token: SeDebugPrivilege	4404	file.exe
Token: SeDebugPrivilege	760	RegAsm.exe

pid	process
760	RegAsm.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

ITEMS CATOLOG SLIDE.execmd.execmd.exefile.exe

description	pid	process	target process
PID 1372 wrote to memory of 5012	1372	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 1372 wrote to memory of 5012	1372	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 1372 wrote to memory of 5012	1372	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 5012 wrote to memory of 3400	5012	cmd.exe	PING.EXE
PID 5012 wrote to memory of 3400	5012	cmd.exe	PING.EXE
PID 5012 wrote to memory of 3400	5012	cmd.exe	PING.EXE
PID 1372 wrote to memory of 380	1372	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 1372 wrote to memory of 380	1372	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 1372 wrote to memory of 380	1372	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 380 wrote to memory of 2152	380	cmd.exe	PING.EXE
PID 380 wrote to memory of 2152	380	cmd.exe	PING.EXE
PID 380 wrote to memory of 2152	380	cmd.exe	PING.EXE
PID 5012 wrote to memory of 3632	5012	cmd.exe	reg.exe
PID 5012 wrote to memory of 3632	5012	cmd.exe	reg.exe
PID 5012 wrote to memory of 3632	5012	cmd.exe	reg.exe
PID 380 wrote to memory of 3020	380	cmd.exe	PING.EXE
PID 380 wrote to memory of 3020	380	cmd.exe	PING.EXE
PID 380 wrote to memory of 3020	380	cmd.exe	PING.EXE
PID 380 wrote to memory of 4404	380	cmd.exe	file.exe
PID 380 wrote to memory of 4404	380	cmd.exe	file.exe
PID 380 wrote to memory of 4404	380	cmd.exe	file.exe
PID 4404 wrote to memory of 760	4404	file.exe	RegAsm.exe
PID 4404 wrote to memory of 760	4404	file.exe	RegAsm.exe
PID 4404 wrote to memory of 760	4404	file.exe	RegAsm.exe
PID 4404 wrote to memory of 760	4404	file.exe	RegAsm.exe
PID 4404 wrote to memory of 760	4404	file.exe	RegAsm.exe
PID 4404 wrote to memory of 760	4404	file.exe	RegAsm.exe
PID 4404 wrote to memory of 760	4404	file.exe	RegAsm.exe
PID 4404 wrote to memory of 760	4404	file.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\ITEMS CATOLOG SLIDE.exe
"C:\Users\Admin\AppData\Local\Temp\ITEMS CATOLOG SLIDE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "files" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 9
3⤵
- Runs ping.exe
PID:3400

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "files" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe"
3⤵
- Adds Run key to start application
PID:3632

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ITEMS CATOLOG SLIDE.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 17
3⤵
- Runs ping.exe
PID:2152

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 17
3⤵
- Runs ping.exe
PID:3020

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe

Filesize
937KB

MD5
4a323d354ce4f623d28481674820af27

SHA1
47c96244f4f6c5ba61b09d97694afbf16707cff8

SHA256
9a40bb86b69f6c6702f4cef6b9b4c51c68d5923a239eaf6ed3029374d13ccee8

SHA512
2f5cec2c419460af012bfc233222db3ba7ba64c2339ac4c2f6dca17377c7cdf4f0cfa4fbec47577f35fcbeee728724483d5e98357681261a9a7cb7675a89fcb3

Download Submit
memory/760-26-0x00000000068C0000-0x0000000006910000-memory.dmp

Filesize
320KB

Download
memory/760-24-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/760-21-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1372-5-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/1372-3-0x0000000005800000-0x0000000005892000-memory.dmp

Filesize
584KB

Download
memory/1372-6-0x0000000005A60000-0x0000000005AFC000-memory.dmp

Filesize
624KB

Download
memory/1372-7-0x0000000006B40000-0x0000000006B84000-memory.dmp

Filesize
272KB

Download
memory/1372-8-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/1372-10-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/1372-4-0x0000000005780000-0x000000000578A000-memory.dmp

Filesize
40KB

Download
memory/1372-0-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/1372-1-0x0000000000990000-0x0000000000A80000-memory.dmp

Filesize
960KB

Download
memory/1372-2-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/4404-16-0x0000000074570000-0x0000000074D20000-memory.dmp

Filesize
7.7MB

Download
memory/4404-20-0x0000000074570000-0x0000000074D20000-memory.dmp

Filesize
7.7MB

Download
memory/4404-19-0x00000000078B0000-0x00000000078B6000-memory.dmp

Filesize
24KB

Download
memory/4404-23-0x0000000074570000-0x0000000074D20000-memory.dmp

Filesize
7.7MB

Download
memory/4404-18-0x0000000007870000-0x000000000788A000-memory.dmp

Filesize
104KB

Download
memory/4404-17-0x0000000000A30000-0x0000000000B20000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads