agenttesla | ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920

General

Target

ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe
Size

1.1MB
MD5

3bf36f75ae271a827541f9bb64bbab51
SHA1

368038436abc04b3409d2ea11687b49145665542
SHA256

ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920
SHA512

17a5c19c91775d6ecb544fff101f79b71e828cd48857dc1659e64f2dbd0e4457ebaf08edde049592ede2d2e559a789d3aa55d9b260e240714094649eee93157c
SSDEEP

24576:/RmJkcoQricOIQxiZY1WNy/IFFq3h+640rSTkDs7n:UJZoQrbTFZY1WNyaSwGDM

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hurtling.vbs	hurtling.exe

Executes dropped EXE 1 IoCs

pid	Process
1848	hurtling.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2380-0-0x0000000000400000-0x00000000004B5000-memory.dmp	autoit_exe
behavioral1/files/0x0008000000016c81-5.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 2240	1848	hurtling.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurtling.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	RegSvcs.exe
2240	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1848	hurtling.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe
2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe
1848	hurtling.exe
1848	hurtling.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe
2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe
1848	hurtling.exe
1848	hurtling.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1848	2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe	30
PID 2380 wrote to memory of 1848	2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe	30
PID 2380 wrote to memory of 1848	2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe	30
PID 2380 wrote to memory of 1848	2380	ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe	30
PID 1848 wrote to memory of 2240	1848	hurtling.exe	31
PID 1848 wrote to memory of 2240	1848	hurtling.exe	31
PID 1848 wrote to memory of 2240	1848	hurtling.exe	31
PID 1848 wrote to memory of 2240	1848	hurtling.exe	31
PID 1848 wrote to memory of 2240	1848	hurtling.exe	31
PID 1848 wrote to memory of 2240	1848	hurtling.exe	31
PID 1848 wrote to memory of 2240	1848	hurtling.exe	31
PID 1848 wrote to memory of 2240	1848	hurtling.exe	31

C:\Users\Admin\AppData\Local\Temp\ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe
"C:\Users\Admin\AppData\Local\Temp\ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\parachronism\hurtling.exe
  "C:\Users\Admin\AppData\Local\Temp\ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\apostrophise

Filesize
239KB

MD5
e61ffe7d424c75edbc5aadc38ed3348d

SHA1
e07e4650bcc7e17e4ea724f182bfa6359bc0dcf2

SHA256
da7b5bff35b158271bab4ee6c7d817184fe7485abca3ca09cddae1cf7379df8e

SHA512
a5470b86952178de1b2e73ff3beea079f931b80b5f2732d90aaa26ab1aa9b35ec7bcc188b1387b381e65615875583e0ec7e63bcbffc192399419740dad4709de

Download Submit
\Users\Admin\AppData\Local\parachronism\hurtling.exe

Filesize
1.1MB

MD5
3bf36f75ae271a827541f9bb64bbab51

SHA1
368038436abc04b3409d2ea11687b49145665542

SHA256
ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920

SHA512
17a5c19c91775d6ecb544fff101f79b71e828cd48857dc1659e64f2dbd0e4457ebaf08edde049592ede2d2e559a789d3aa55d9b260e240714094649eee93157c

Download Submit
memory/1848-15-0x0000000003B50000-0x0000000003D50000-memory.dmp

Filesize
2.0MB

Download
memory/2240-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2240-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2240-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2240-22-0x00000000743BE000-0x00000000743BF000-memory.dmp

Filesize
4KB

Download
memory/2240-23-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2240-24-0x00000000743BE000-0x00000000743BF000-memory.dmp

Filesize
4KB

Download
memory/2240-25-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-3-0x0000000003720000-0x0000000003920000-memory.dmp

Filesize
2.0MB

Download
memory/2380-10-0x0000000003720000-0x0000000003920000-memory.dmp

Filesize
2.0MB

Download
memory/2380-2-0x0000000003720000-0x0000000003920000-memory.dmp

Filesize
2.0MB

Download
memory/2380-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download

Analysis

Sharing