agenttesla | 16f661258c7572ebd08fa986cfe3e2f1b24196d366d048102900e60979f42ca4

General

Target

Swift copy.doc...exe
Size

619KB
MD5

e5804ae69d56f7a6a61cebed35496ab3
SHA1

36a0ae19084417b1c8a148946f80512ea4666d47
SHA256

16f661258c7572ebd08fa986cfe3e2f1b24196d366d048102900e60979f42ca4
SHA512

f54b387cde1a75c816c2cb9dc415cf9a076c256b061055bbfda055bd9214f9d0b1e1c61d207391b26684a781cb8f167f083187774a4e6381b0ceca8af0023d0e

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vivaldi.net
Port:
587
Username:
smith45333@vivaldi.net
Password:
1234567812345678az

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/268-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/268-5-0x00000000004471BE-mapping.dmp	family_agenttesla
behavioral1/memory/268-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/268-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\FHDzY = "C:\\Users\\Admin\\AppData\\Roaming\\FHDzY\\FHDzY.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Swift copy.doc...exe

description pid process target process

PID 1588 set thread context of 268 1588 Swift copy.doc...exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1900 schtasks.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

2012 REG.exe

description	pid	process	target process
PID 1588 set thread context of 268	1588	Swift copy.doc...exe	RegSvcs.exe

pid	process
1900	schtasks.exe

pid	process
2012	REG.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Swift copy.doc...exeRegSvcs.exe

pid	process
1588	Swift copy.doc...exe
1588	Swift copy.doc...exe
1588	Swift copy.doc...exe
1588	Swift copy.doc...exe
1588	Swift copy.doc...exe
268	RegSvcs.exe
268	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Swift copy.doc...exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1588 Swift copy.doc...exe
Token: SeDebugPrivilege 268 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1588	Swift copy.doc...exe
Token: SeDebugPrivilege	268	RegSvcs.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

Swift copy.doc...exeRegSvcs.exe

description	pid	process	target process
PID 1588 wrote to memory of 1900	1588	Swift copy.doc...exe	schtasks.exe
PID 1588 wrote to memory of 1900	1588	Swift copy.doc...exe	schtasks.exe
PID 1588 wrote to memory of 1900	1588	Swift copy.doc...exe	schtasks.exe
PID 1588 wrote to memory of 1900	1588	Swift copy.doc...exe	schtasks.exe
PID 1588 wrote to memory of 1824	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1824	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1824	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1824	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1824	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1824	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1824	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1836	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1836	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1836	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1836	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1836	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1836	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1836	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1832	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1832	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1832	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1832	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1832	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1832	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 1832	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 1588 wrote to memory of 268	1588	Swift copy.doc...exe	RegSvcs.exe
PID 268 wrote to memory of 2012	268	RegSvcs.exe	REG.exe
PID 268 wrote to memory of 2012	268	RegSvcs.exe	REG.exe
PID 268 wrote to memory of 2012	268	RegSvcs.exe	REG.exe
PID 268 wrote to memory of 2012	268	RegSvcs.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\Swift copy.doc...exe
"C:\Users\Admin\AppData\Local\Temp\Swift copy.doc...exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2F3A.tmp"
2⤵
- Creates scheduled task(s)
PID:1900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
3⤵
- Modifies registry key
PID:2012

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2F3A.tmp
MD5
619935892dc702a7d2a1ef69008cc070

SHA1
2698088ce411926ae6f09aaa933c6ff185b7e4ca

SHA256
ba7948a38e0de3c4c14fd1e5c8b573a52fb4eb216dc29206619b2d5dd37cd6a1

SHA512
bf3c44a52090d70a2edac163003c8419f35a9835494aae2bb489bc177cf2bd6bde1624baa3cf795f0b7904a38ce5036b845482fa87e68c9f0f8974cbd59ef2e4

Download Submit
memory/268-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-5-0x00000000004471BE-mapping.dmp

Download
memory/268-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1588-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1900-2-0x0000000000000000-mapping.dmp

Download
memory/2012-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads