agenttesla | 5046cb3e7954bc8bc9c76603bb1be13d3e1839cb57b5fbcad1e0008d0aa2e5e3

General

Target

doc0029388484859996.bat.exe
Size

520KB
MD5

a3b9350d1b3df23db1b51c290b4af29d
SHA1

81a32852f02c2602f3c60094fe7c339225fc115b
SHA256

5046cb3e7954bc8bc9c76603bb1be13d3e1839cb57b5fbcad1e0008d0aa2e5e3
SHA512

c39a2004db216d4851a7a06bc4916ce23e3c74d164c127440b38e8d7e1c4525d332790fd0d6137a8956d7efae1f6320862d84d3dc07673f6e43edb34ea23d9c7
SSDEEP

12288:karCpZAGA6yYsKAtOw+Qe4NigsmhhygoRu6X1:1rozA6z0t+Qe4vsYySG1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.dachangshelving.id
Port:
21
Username:
[email protected]
Password:
boygirl123456

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Loads dropped DLL 1 IoCs

Processes:

doc0029388484859996.bat.exe

pid process

3964 doc0029388484859996.bat.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

46 ip-api.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

doc0029388484859996.bat.exe

pid process

1316 doc0029388484859996.bat.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

doc0029388484859996.bat.exedoc0029388484859996.bat.exe

pid process

3964 doc0029388484859996.bat.exe
1316 doc0029388484859996.bat.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

doc0029388484859996.bat.exe

description pid process target process

PID 3964 set thread context of 1316 3964 doc0029388484859996.bat.exe doc0029388484859996.bat.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

doc0029388484859996.bat.exe

pid process

1316 doc0029388484859996.bat.exe
1316 doc0029388484859996.bat.exe
1316 doc0029388484859996.bat.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

doc0029388484859996.bat.exe

pid process

3964 doc0029388484859996.bat.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

doc0029388484859996.bat.exe

description pid process

Token: SeDebugPrivilege 1316 doc0029388484859996.bat.exe

pid	process
3964	doc0029388484859996.bat.exe

flow	ioc
46	ip-api.com

pid	process
1316	doc0029388484859996.bat.exe

pid	process
3964	doc0029388484859996.bat.exe
1316	doc0029388484859996.bat.exe

description	pid	process	target process
PID 3964 set thread context of 1316	3964	doc0029388484859996.bat.exe	doc0029388484859996.bat.exe

pid	process
1316	doc0029388484859996.bat.exe
1316	doc0029388484859996.bat.exe
1316	doc0029388484859996.bat.exe

pid	process
3964	doc0029388484859996.bat.exe

description	pid	process
Token: SeDebugPrivilege	1316	doc0029388484859996.bat.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

doc0029388484859996.bat.exe

description	pid	process	target process
PID 3964 wrote to memory of 1316	3964	doc0029388484859996.bat.exe	doc0029388484859996.bat.exe
PID 3964 wrote to memory of 1316	3964	doc0029388484859996.bat.exe	doc0029388484859996.bat.exe
PID 3964 wrote to memory of 1316	3964	doc0029388484859996.bat.exe	doc0029388484859996.bat.exe
PID 3964 wrote to memory of 1316	3964	doc0029388484859996.bat.exe	doc0029388484859996.bat.exe
PID 3964 wrote to memory of 1316	3964	doc0029388484859996.bat.exe	doc0029388484859996.bat.exe

C:\Users\Admin\AppData\Local\Temp\doc0029388484859996.bat.exe
"C:\Users\Admin\AppData\Local\Temp\doc0029388484859996.bat.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3964

C:\Users\Admin\AppData\Local\Temp\doc0029388484859996.bat.exe
"C:\Users\Admin\AppData\Local\Temp\doc0029388484859996.bat.exe"
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\rasterside.ini
Filesize
39B

MD5
dc764daea004e907e2a4076dc2e81dce

SHA1
64cc2f14c8426031e8fe9995da24887ff5beec97

SHA256
8a3dd54acac47298afa45e7048a9297f897e35cb351e511fbe5a421b1ed6523d

SHA512
f03e8c65e1974e8bc1608e292a9898054c791b5e8505b8bbd5f9eb832cd414c3fb19f7e328286984cc73a07937d60731dd00f20c3e31db77245a2f178e5bf257

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr3C88.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
memory/1316-47-0x00000000722AE000-0x00000000722AF000-memory.dmp

Filesize
4KB

Download
memory/1316-48-0x0000000000470000-0x00000000004B2000-memory.dmp

Filesize
264KB

Download
memory/1316-42-0x0000000077968000-0x0000000077969000-memory.dmp

Filesize
4KB

Download
memory/1316-43-0x0000000077985000-0x0000000077986000-memory.dmp

Filesize
4KB

Download
memory/1316-46-0x00000000778E1000-0x0000000077A01000-memory.dmp

Filesize
1.1MB

Download
memory/1316-44-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/1316-58-0x00000000722A0000-0x0000000072A50000-memory.dmp

Filesize
7.7MB

Download
memory/1316-57-0x00000000722AE000-0x00000000722AF000-memory.dmp

Filesize
4KB

Download
memory/1316-49-0x0000000038810000-0x0000000038DB4000-memory.dmp

Filesize
5.6MB

Download
memory/1316-50-0x00000000722A0000-0x0000000072A50000-memory.dmp

Filesize
7.7MB

Download
memory/1316-51-0x0000000038760000-0x00000000387C6000-memory.dmp

Filesize
408KB

Download
memory/1316-52-0x0000000039660000-0x00000000396B0000-memory.dmp

Filesize
320KB

Download
memory/1316-53-0x00000000396C0000-0x0000000039752000-memory.dmp

Filesize
584KB

Download
memory/1316-54-0x0000000039780000-0x000000003978A000-memory.dmp

Filesize
40KB

Download
memory/3964-41-0x0000000074744000-0x0000000074745000-memory.dmp

Filesize
4KB

Download
memory/3964-40-0x00000000778E1000-0x0000000077A01000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing