agenttesla | dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af

General

Target

dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
Size

887KB
MD5

e563153089b05a25e30db0a73e196b10
SHA1

fb098be6dc900c18c83b53681cc0fd2c976fe638
SHA256

dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af
SHA512

17e30159b45bfcdd51060402035df22aac990462f2cd6030d5a706365334324972516beb206e061250f22bea6d5c559c2f607bf47742612dcae03f909c959b0d
SSDEEP

24576:eJi2vF8oJn4gGSBy/65Sq+6tOhMAP63ACF25:eh8oF/G//6c6+MAP6bW

Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
oadc jzrw bmvr klnl

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
oadc jzrw bmvr klnl
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Loads dropped DLL 7 IoCs

pid	Process
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org
6	api.ipify.org

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\spankingerne\Vidnesbyrd.Syn106	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
File created	C:\Windows\SysWOW64\Dogmefastes.lnk	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
File opened for modification	C:\Windows\SysWOW64\Dogmefastes.lnk	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1872	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
1872	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 1872	2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe	31

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\eudaemons.ini	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Opkomlinge\undersluice.yed	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
File opened for modification	C:\Windows\resources\lizis\seadromes.ett	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
File opened for modification	C:\Windows\resources\sygelejet\devested.per	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
File opened for modification	C:\Windows\totlafholdenhedens\Sagittaries.ini	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1872	wab.exe
1872	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	wab.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1872	2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe	31
PID 2796 wrote to memory of 1872	2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe	31
PID 2796 wrote to memory of 1872	2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe	31
PID 2796 wrote to memory of 1872	2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe	31
PID 2796 wrote to memory of 1872	2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe	31
PID 2796 wrote to memory of 1872	2796	dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe	31

C:\Users\Admin\AppData\Local\Temp\dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe
"C:\Users\Admin\AppData\Local\Temp\dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\windows mail\wab.exe
  "C:\Users\Admin\AppData\Local\Temp\dbd76943d4c2efa432805b8458e970c2b6c6d76c16ff4d2a7d63df50ad0330af.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Pictures\Milliluxes.lnk

Filesize
978B

MD5
74ecbc8998a1b15bf5f15920cf6ba7e6

SHA1
980a98a428849c91067796572fe7f050d8f00a15

SHA256
d88a7a7e2feebf1872151da726f644c90dfcd90a816366771c61c2f209c80c61

SHA512
700a313bbdf0efb78b365493ed2518b11419a69acbeb7841b38154c5dcd2c7f5bdb9ae70b9519531544ed02be4aa087addb5a627d737a0617ee38bbe9cb9f2bd

Download Submit
C:\Windows\SysWOW64\Dogmefastes.lnk

Filesize
1KB

MD5
c1f6957a3b8931839631b2ce26e3579c

SHA1
5a8d4d14008f53de19f4eafd655afa8d45520db3

SHA256
c3781a7d45c18d5b867f5e88f24ef26d3bd50bdc55c488c40878771f9f0b5683

SHA512
77fc8349e9e4abe7a1b594bf15afea6882694a5286f8351005757ae831c0db54ad591accb1d707cfd728220946b4c93a81c5db21fe318518a9a467016ef2faef

Download Submit
\Users\Admin\AppData\Local\Temp\nstF7B9.tmp\LangDLL.dll

Filesize
5KB

MD5
f1e9eed02db3a822a7ddef0c724e5f1f

SHA1
65864992f5b6c79c5efbefb5b1354648a8a86709

SHA256
6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df

SHA512
c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c

Download Submit
\Users\Admin\AppData\Local\Temp\nstF7B9.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
memory/1872-634-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/1872-635-0x0000000000660000-0x00000000016C2000-memory.dmp

Filesize
16.4MB

Download
memory/1872-636-0x0000000000660000-0x00000000006A4000-memory.dmp

Filesize
272KB

Download
memory/2796-632-0x0000000077491000-0x0000000077592000-memory.dmp

Filesize
1.0MB

Download
memory/2796-633-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads