agenttesla | 8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b

General

Target

8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe
Size

1.1MB
MD5

e1f5e820f3cc517274cfb73f4e09f1e2
SHA1

f3c7954e415e73fcdef51171aa55155a9e4fa426
SHA256

8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b
SHA512

3dfcbaf9ed039babfc68b6746ee9c65a88213820cb203affa0183340e2013fc83a4bdf20126df88019c3d677492f3977f9352e01ca4dad100cbb1ae364688223
SSDEEP

24576:+AHnh+eWsN3skA4RV1Hom2KXMmHa57GZp0R2NW/5:ph+ZkldoPK8Ya57GZQ2k

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.electromedica.com
Port:
587
Username:
[email protected]
Password:
2018A723?v
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs

resource	yara_rule
behavioral2/memory/4852-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/4852-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/4852-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4852-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4852-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4852-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
3532	name.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZFzKrzC = "C:\\Users\\Admin\\AppData\\Roaming\\ZFzKrzC\\ZFzKrzC.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
25	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00080000000233cd-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3532 set thread context of 4852	3532	name.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	RegSvcs.exe
4852	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3532	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1528	8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe
1528	8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe
3532	name.exe
3532	name.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1528	8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe
1528	8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe
3532	name.exe
3532	name.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 3532	1528	8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe	84
PID 1528 wrote to memory of 3532	1528	8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe	84
PID 1528 wrote to memory of 3532	1528	8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe	84
PID 3532 wrote to memory of 4852	3532	name.exe	85
PID 3532 wrote to memory of 4852	3532	name.exe	85
PID 3532 wrote to memory of 4852	3532	name.exe	85
PID 3532 wrote to memory of 4852	3532	name.exe	85

C:\Users\Admin\AppData\Local\Temp\8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe
"C:\Users\Admin\AppData\Local\Temp\8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\atule

Filesize
236KB

MD5
f011adc41af3221e0178b619456e4ad8

SHA1
a02a16cacd9ab5cced13467a733012902b11a49d

SHA256
4e45933a7c00715d4d2e1c20a2fb1254323b288e670a139bb617056e6a5fb4ab

SHA512
5fa58c72e508f05d4d8c4bf1086ae98100872f864c9dbfd29b14a91bfc4b887c13cee8ce6fc8c5ef9b2ad87594a1d209c60a3232ca11644ac396bcc02f5ede7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cacostomia

Filesize
28KB

MD5
6f29e15f78332891bdfb36cb4fbc339c

SHA1
6ce909c2d7f3adfe44e3f116ccd0b880bd5735d0

SHA256
ab2f123186e8c587286b94f4828043d47c6a0b539242fa9d023bc59beba2de0b

SHA512
976fbe1d206ad00ef2a770e9ad2d2ab11b79a25848a62f5641a86728d523f48fd36c90e5c3e7cfdac3895a044ba4ac25942b1f67e7acd83de2b416a5869265d0

Download Submit
C:\Users\Admin\AppData\Local\directory\name.exe

Filesize
1.1MB

MD5
e1f5e820f3cc517274cfb73f4e09f1e2

SHA1
f3c7954e415e73fcdef51171aa55155a9e4fa426

SHA256
8878f15cafbcb057a086d9e13afc279622885d29c9f51daa8ca67336ebaa455b

SHA512
3dfcbaf9ed039babfc68b6746ee9c65a88213820cb203affa0183340e2013fc83a4bdf20126df88019c3d677492f3977f9352e01ca4dad100cbb1ae364688223

Download Submit
memory/1528-10-0x0000000000FF0000-0x0000000000FF4000-memory.dmp

Filesize
16KB

Download
memory/4852-30-0x00000000058B0000-0x0000000005E54000-memory.dmp

Filesize
5.6MB

Download
memory/4852-29-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/4852-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-31-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/4852-32-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/4852-34-0x0000000006740000-0x0000000006790000-memory.dmp

Filesize
320KB

Download
memory/4852-35-0x0000000006830000-0x00000000068C2000-memory.dmp

Filesize
584KB

Download
memory/4852-36-0x00000000067B0000-0x00000000067BA000-memory.dmp

Filesize
40KB

Download
memory/4852-37-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/4852-38-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads