agenttesla | 086a61b8e021002733d2e13242c82ca64d6834ec97343d742fee3c07e27ff9f8

General

Target

New Order NO-19006022.pif.exe
Size

682KB
MD5

5359c05ea8f32da860c3bc0ca3b1bfea
SHA1

c6be1096c68834b4e3adaaf74d7e88e5a5a9637f
SHA256

086a61b8e021002733d2e13242c82ca64d6834ec97343d742fee3c07e27ff9f8
SHA512

fc165913c8c886c9eb956992228cadf5408c93eeb8eb51cddfaaf6893ae1d9f9614607ecdfa73de5a2b16cea55a524e467e405f2e71820dc405582936b8193d6
SSDEEP

12288:bNgLeFR62plv312Z3Ssqcks4oMfQfLRlqfsbW7GOVlwj6KgFjpNoYRowIa6Rxh3u:LpJ312ZSsqFCLRQfIvO/w2F9HTRoJx

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.voivocars.com
Port:
587
Username:
mullar460@voivocars.com
Password:
Gempaid
Email To:
mrmullar@voivocars.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

New Order NO-19006022.pif.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	New Order NO-19006022.pif.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

New Order NO-19006022.pif.exe

description pid process target process

PID 1384 set thread context of 3676 1384 New Order NO-19006022.pif.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3060 schtasks.exe

flow	ioc
8	api.ipify.org

description	pid	process	target process
PID 1384 set thread context of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe

pid	process
3060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

New Order NO-19006022.pif.exepowershell.exepowershell.exeRegSvcs.exe

pid	process
1384	New Order NO-19006022.pif.exe
1384	New Order NO-19006022.pif.exe
1800	powershell.exe
5108	powershell.exe
1384	New Order NO-19006022.pif.exe
3676	RegSvcs.exe
3676	RegSvcs.exe
5108	powershell.exe
1800	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

New Order NO-19006022.pif.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1384	New Order NO-19006022.pif.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	3676	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

New Order NO-19006022.pif.exe

description	pid	process	target process
PID 1384 wrote to memory of 1800	1384	New Order NO-19006022.pif.exe	powershell.exe
PID 1384 wrote to memory of 1800	1384	New Order NO-19006022.pif.exe	powershell.exe
PID 1384 wrote to memory of 1800	1384	New Order NO-19006022.pif.exe	powershell.exe
PID 1384 wrote to memory of 5108	1384	New Order NO-19006022.pif.exe	powershell.exe
PID 1384 wrote to memory of 5108	1384	New Order NO-19006022.pif.exe	powershell.exe
PID 1384 wrote to memory of 5108	1384	New Order NO-19006022.pif.exe	powershell.exe
PID 1384 wrote to memory of 3060	1384	New Order NO-19006022.pif.exe	schtasks.exe
PID 1384 wrote to memory of 3060	1384	New Order NO-19006022.pif.exe	schtasks.exe
PID 1384 wrote to memory of 3060	1384	New Order NO-19006022.pif.exe	schtasks.exe
PID 1384 wrote to memory of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe
PID 1384 wrote to memory of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe
PID 1384 wrote to memory of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe
PID 1384 wrote to memory of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe
PID 1384 wrote to memory of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe
PID 1384 wrote to memory of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe
PID 1384 wrote to memory of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe
PID 1384 wrote to memory of 3676	1384	New Order NO-19006022.pif.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\New Order NO-19006022.pif.exe
"C:\Users\Admin\AppData\Local\Temp\New Order NO-19006022.pif.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\New Order NO-19006022.pif.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KjwZFzRPPl.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KjwZFzRPPl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7AFC.tmp"
2⤵
- Creates scheduled task(s)
PID:3060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
64c5374c58ccfc4c12c556afc248d0fd

SHA1
67d9363dd84420f7814ed38547aa15ca2a4f2829

SHA256
84ace0ff5613f55e86a90e3a41a77a3f0766b829c069514834520fe208ec3615

SHA512
f33de8adc3ddb9b262340ddd15513e18ca2342c35c1c8bc4edaacf587932caef5b75395436919e5dae5ac23ac74269beba57a31fac59e8baec510983619cbc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k0sfgtjd.zym.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7AFC.tmp
Filesize
1KB

MD5
6f7ecc041a825ffa1fe64d7334103ed0

SHA1
5d7a4df5eea1d27b7966747db72115b0628932e3

SHA256
75dc26dc17868ffa7ad59bd6a118fbde876845547577f04781d461102191ef5e

SHA512
87849e356a13300d4d1dd129f6551ab90e8be1bf9257b47d8e97958a7117738e8fb5e86a9534c13a3a36a7f9dc7670df411132823a6752c9688245c525aca387

Download Submit
memory/1384-7-0x0000000005EB0000-0x0000000005EC4000-memory.dmp

Filesize
80KB

Download
memory/1384-3-0x00000000059D0000-0x0000000005A62000-memory.dmp

Filesize
584KB

Download
memory/1384-6-0x0000000005C00000-0x0000000005C20000-memory.dmp

Filesize
128KB

Download
memory/1384-46-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/1384-8-0x00000000094A0000-0x0000000009522000-memory.dmp

Filesize
520KB

Download
memory/1384-9-0x000000000C5D0000-0x000000000C66C000-memory.dmp

Filesize
624KB

Download
memory/1384-5-0x00000000059A0000-0x00000000059AA000-memory.dmp

Filesize
40KB

Download
memory/1384-1-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/1384-0-0x0000000000F00000-0x0000000000FB0000-memory.dmp

Filesize
704KB

Download
memory/1384-2-0x0000000005EE0000-0x0000000006484000-memory.dmp

Filesize
5.6MB

Download
memory/1384-4-0x00000000059B0000-0x00000000059C0000-memory.dmp

Filesize
64KB

Download
memory/1800-14-0x0000000000F90000-0x0000000000FC6000-memory.dmp

Filesize
216KB

Download
memory/1800-86-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/1800-19-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/1800-80-0x0000000007350000-0x0000000007358000-memory.dmp

Filesize
32KB

Download
memory/1800-79-0x0000000007370000-0x000000000738A000-memory.dmp

Filesize
104KB

Download
memory/1800-16-0x0000000004E60000-0x0000000005488000-memory.dmp

Filesize
6.2MB

Download
memory/1800-78-0x0000000007270000-0x0000000007284000-memory.dmp

Filesize
80KB

Download
memory/1800-17-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/1800-15-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/1800-61-0x0000000071500000-0x000000007154C000-memory.dmp

Filesize
304KB

Download
memory/1800-75-0x00000000072B0000-0x0000000007346000-memory.dmp

Filesize
600KB

Download
memory/1800-48-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Filesize
304KB

Download
memory/1800-74-0x00000000070A0000-0x00000000070AA000-memory.dmp

Filesize
40KB

Download
memory/3676-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3676-88-0x0000000006A50000-0x0000000006AA0000-memory.dmp

Filesize
320KB

Download
memory/5108-77-0x0000000007370000-0x000000000737E000-memory.dmp

Filesize
56KB

Download
memory/5108-76-0x0000000007340000-0x0000000007351000-memory.dmp

Filesize
68KB

Download
memory/5108-73-0x0000000007140000-0x000000000715A000-memory.dmp

Filesize
104KB

Download
memory/5108-72-0x0000000007780000-0x0000000007DFA000-memory.dmp

Filesize
6.5MB

Download
memory/5108-41-0x00000000058E0000-0x0000000005C34000-memory.dmp

Filesize
3.3MB

Download
memory/5108-47-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Filesize
120KB

Download
memory/5108-71-0x0000000006E20000-0x0000000006EC3000-memory.dmp

Filesize
652KB

Download
memory/5108-60-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/5108-50-0x0000000071500000-0x000000007154C000-memory.dmp

Filesize
304KB

Download
memory/5108-22-0x0000000004E60000-0x0000000004E82000-memory.dmp

Filesize
136KB

Download
memory/5108-23-0x0000000004F80000-0x0000000004FE6000-memory.dmp

Filesize
408KB

Download
memory/5108-24-0x00000000050A0000-0x0000000005106000-memory.dmp

Filesize
408KB

Download
memory/5108-18-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/5108-87-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/5108-20-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/5108-49-0x0000000006DE0000-0x0000000006E12000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads