agenttesla | b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69

General

Target

b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe
Size

867KB
MD5

3905d8eb530a872db92e514962ce18d5
SHA1

4e942ecbe869a151c28c7bc0d8dbebc1e5342a98
SHA256

b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69
SHA512

b2587d21436c798d75afbd31664f4832c4624fd8d90c849b97dcc8c2c886c874901c348f0303c89bace0787d6030e30c28a40f813920890268b96431d48c4a59
SSDEEP

24576:0thEVaPqLqnIAGJDgwsOe1Vd1yZec45vUJRQlgBdL:IEVUcBAG1gwFoHsd4VULQlkL

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\horrify.vbs	horrify.exe

Executes dropped EXE 1 IoCs

pid	Process
2764	horrify.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1260-9-0x0000000000400000-0x00000000004E6000-memory.dmp	autoit_exe
behavioral2/memory/2764-21-0x0000000000400000-0x00000000004E6000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2764 set thread context of 5052	2764	horrify.exe	84

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1260-0-0x0000000000400000-0x00000000004E6000-memory.dmp	upx
behavioral2/files/0x0007000000023c66-6.dat	upx
behavioral2/memory/1260-9-0x0000000000400000-0x00000000004E6000-memory.dmp	upx
behavioral2/memory/2764-21-0x0000000000400000-0x00000000004E6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	2764	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	horrify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5052	RegSvcs.exe
5052	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2764	horrify.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1260	b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe
1260	b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe
2764	horrify.exe
2764	horrify.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1260	b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe
1260	b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe
2764	horrify.exe
2764	horrify.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2764	1260	b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe	83
PID 1260 wrote to memory of 2764	1260	b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe	83
PID 1260 wrote to memory of 2764	1260	b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe	83
PID 2764 wrote to memory of 5052	2764	horrify.exe	84
PID 2764 wrote to memory of 5052	2764	horrify.exe	84
PID 2764 wrote to memory of 5052	2764	horrify.exe	84
PID 2764 wrote to memory of 5052	2764	horrify.exe	84

C:\Users\Admin\AppData\Local\Temp\b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe
"C:\Users\Admin\AppData\Local\Temp\b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\troopwise\horrify.exe
  "C:\Users\Admin\AppData\Local\Temp\b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 736
    3⤵
    - Program crash
    PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2764 -ip 2764
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\epistemology

Filesize
239KB

MD5
f66e84f9d49734e5b56dc7f7fd6fd23f

SHA1
1cba127e5072f939407c7313554858c7dceb0115

SHA256
e6afdb03f6cf547388c11500e9d2109ee3c58a074dc1c123cf8329f88684d829

SHA512
0ee03032ca01c156a5b35988ec7d80f5d60365c544b99883aadaa7aa01e24d576c75cc75d5dbe5c0225826248a2699189df86aa1a0fe8235bb5553cc519e9ee1

Download Submit
C:\Users\Admin\AppData\Local\troopwise\horrify.exe

Filesize
867KB

MD5
3905d8eb530a872db92e514962ce18d5

SHA1
4e942ecbe869a151c28c7bc0d8dbebc1e5342a98

SHA256
b8cc09436362f744e7ceb7fdbcbbe53b0de7741e6584b35520c9a38937b35c69

SHA512
b2587d21436c798d75afbd31664f4832c4624fd8d90c849b97dcc8c2c886c874901c348f0303c89bace0787d6030e30c28a40f813920890268b96431d48c4a59

Download Submit
memory/1260-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/1260-3-0x0000000004180000-0x0000000004380000-memory.dmp

Filesize
2.0MB

Download
memory/1260-9-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2764-13-0x0000000003D50000-0x0000000003F50000-memory.dmp

Filesize
2.0MB

Download
memory/2764-21-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/5052-17-0x00000000054C0000-0x0000000005A64000-memory.dmp

Filesize
5.6MB

Download
memory/5052-16-0x000000007391E000-0x000000007391F000-memory.dmp

Filesize
4KB

Download
memory/5052-18-0x0000000004F80000-0x0000000004FE6000-memory.dmp

Filesize
408KB

Download
memory/5052-19-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download
memory/5052-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5052-22-0x0000000006260000-0x00000000062B0000-memory.dmp

Filesize
320KB

Download
memory/5052-23-0x0000000006350000-0x00000000063E2000-memory.dmp

Filesize
584KB

Download
memory/5052-24-0x00000000062E0000-0x00000000062EA000-memory.dmp

Filesize
40KB

Download
memory/5052-25-0x000000007391E000-0x000000007391F000-memory.dmp

Filesize
4KB

Download
memory/5052-26-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing