agenttesla | 86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe

General

Target

86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe.exe
Size

531KB
MD5

fe3bcba4cdc4ae741ee54de500496669
SHA1

e27ac7c118efb35b85abf8dc4300a6291737dea2
SHA256

86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe
SHA512

d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8
SSDEEP

6144:+Y8i9d6ihOq761Mymf40IoBdLlNZ4DYvP+TV5lKiecmMlGvtClbUpEjoltWucv:8K6+L761MymflCYX+EixjlGHu8ltWuq

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.showpiece.trillennium.biz
Port:
587
Username:
[email protected]
Password:
]2p65r?5jH32
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-40-0x00000000007E0000-0x0000000001842000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2020-43-0x00000000007E0000-0x0000000000820000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-40-0x00000000007E0000-0x0000000001842000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2020-43-0x00000000007E0000-0x0000000000820000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-40-0x00000000007E0000-0x0000000001842000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2020-43-0x00000000007E0000-0x0000000000820000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-40-0x00000000007E0000-0x0000000001842000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2020-43-0x00000000007E0000-0x0000000000820000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-40-0x00000000007E0000-0x0000000001842000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2020-43-0x00000000007E0000-0x0000000000820000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-40-0x00000000007E0000-0x0000000001842000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2020-43-0x00000000007E0000-0x0000000000820000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2348 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

powershell.exeAwner.exe

pid process

2348 powershell.exe
2020 Awner.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\\Altsaxofonists\\').Folkesocialisternes;%Straaets% ($masooka)"	reg.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 api.ipify.org
8 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Awner.exe

pid process

2020 Awner.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exeAwner.exe

pid process

2348 powershell.exe
2020 Awner.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2348 set thread context of 2020 2348 powershell.exe Awner.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
9	api.ipify.org
8	api.ipify.org

pid	process
2020	Awner.exe

description	pid	process	target process
PID 2348 set thread context of 2020	2348	powershell.exe	Awner.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Awner.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\Awner.exe	nsis_installer_2

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2616 reg.exe

pid	process
2616	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Awner.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Awner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Awner.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exeAwner.exe

pid	process
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
2020	Awner.exe
2020	Awner.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2348 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeAwner.exe

description pid process

Token: SeDebugPrivilege 2348 powershell.exe
Token: SeDebugPrivilege 2020 Awner.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Awner.exe

pid process

2020 Awner.exe

description	pid	process
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2020	Awner.exe

pid	process
2020	Awner.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe.exepowershell.exeAwner.execmd.exe

description	pid	process	target process
PID 1048 wrote to memory of 2348	1048	86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe.exe	powershell.exe
PID 1048 wrote to memory of 2348	1048	86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe.exe	powershell.exe
PID 1048 wrote to memory of 2348	1048	86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe.exe	powershell.exe
PID 1048 wrote to memory of 2348	1048	86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe.exe	powershell.exe
PID 2348 wrote to memory of 1036	2348	powershell.exe	cmd.exe
PID 2348 wrote to memory of 1036	2348	powershell.exe	cmd.exe
PID 2348 wrote to memory of 1036	2348	powershell.exe	cmd.exe
PID 2348 wrote to memory of 1036	2348	powershell.exe	cmd.exe
PID 2348 wrote to memory of 2020	2348	powershell.exe	Awner.exe
PID 2348 wrote to memory of 2020	2348	powershell.exe	Awner.exe
PID 2348 wrote to memory of 2020	2348	powershell.exe	Awner.exe
PID 2348 wrote to memory of 2020	2348	powershell.exe	Awner.exe
PID 2348 wrote to memory of 2020	2348	powershell.exe	Awner.exe
PID 2348 wrote to memory of 2020	2348	powershell.exe	Awner.exe
PID 2020 wrote to memory of 2064	2020	Awner.exe	cmd.exe
PID 2020 wrote to memory of 2064	2020	Awner.exe	cmd.exe
PID 2020 wrote to memory of 2064	2020	Awner.exe	cmd.exe
PID 2020 wrote to memory of 2064	2020	Awner.exe	cmd.exe
PID 2064 wrote to memory of 2616	2064	cmd.exe	reg.exe
PID 2064 wrote to memory of 2616	2064	cmd.exe	reg.exe
PID 2064 wrote to memory of 2616	2064	cmd.exe	reg.exe
PID 2064 wrote to memory of 2616	2064	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe.exe
"C:\Users\Admin\AppData\Local\Temp\86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Treholdsskiftet=Get-Content 'C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.Pre';$Skiameter=$Treholdsskiftet.SubString(55621,3);.$Skiameter($Treholdsskiftet)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
3⤵
PID:1036

C:\Users\Admin\AppData\Local\Temp\Awner.exe
"C:\Users\Admin\AppData\Local\Temp\Awner.exe"
3⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\Altsaxofonists\').Folkesocialisternes;%Straaets% ($masooka)"
4⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\Altsaxofonists\').Folkesocialisternes;%Straaets% ($masooka)"
5⤵
- Adds Run key to start application
- Modifies registry key
PID:2616

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Awner.exe
Filesize
531KB

MD5
fe3bcba4cdc4ae741ee54de500496669

SHA1
e27ac7c118efb35b85abf8dc4300a6291737dea2

SHA256
86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe

SHA512
d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8

Download Submit
C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Delfiteknikkens.Gri
Filesize
297KB

MD5
6ea9e79b54b8a56cec498b93e929ece2

SHA1
9481a950ed835695cbb46c6ca48a524f295d4fd2

SHA256
30d6aa82f35ba4d346c05e6b6e825201641cf484c4ab8f343a18c32388d53931

SHA512
468da5be68dfc29c6a1f53fed2ca8f3671f129a16af5291138d4aff384dba6e7ae8b3bb9e32ee73063d85c370d5f5253a53f2a1e1951320d1cc7eabff8ca358e

Download Submit
C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.Pre
Filesize
54KB

MD5
22252e2ecc5fad588b2a1855271240d7

SHA1
16e3f7b4f36b0804f372e9dc199748eced0be25c

SHA256
d82ec244a3f9172ac6eb88f87b46147b085b1ef3cd0b1787cb7029f5eeef74c0

SHA512
98ca2f227d5e8e32a098f8c98c432f1693617196ca3dfd81404ff247a8e8254c631cc291965b0a8fb724798c98bc4dc65963d23c81ebbbd7762acb391b4361a0

Download Submit
memory/2020-40-0x00000000007E0000-0x0000000001842000-memory.dmp

Filesize
16.4MB

Download
memory/2020-43-0x00000000007E0000-0x0000000000820000-memory.dmp

Filesize
256KB

Download
memory/2348-19-0x0000000002900000-0x0000000002940000-memory.dmp

Filesize
256KB

Download
memory/2348-23-0x0000000006570000-0x000000000812D000-memory.dmp

Filesize
27.7MB

Download
memory/2348-41-0x0000000002900000-0x0000000002940000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads