agenttesla | 39a76f88dd2a2ebc1ef8a21c852813b486cb969d062a973610b60eeaef436e11

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7v200722
submitted
13/10/2020, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice pdf pdf pdf.exe
Size 74KB
Sample201013-cvaenmlwn2
SHA256 39a76f88dd2a2ebc1ef8a21c852813b486cb969d062a973610b60eeaef436e11
MD5 4c420c50f66b416a244d38c8b255638a
SHA1 ece5813bbcbb9e67516ffabfc285f909a0a99a9e
SHA512 6f229e6976e8dc51ec0c0bfc2de223b0961979de69d24b7f36f8b6c87815c9f6f3191cd2106bd80160d59d9e65c1affed5eef4e9e42c7b2d2f3106360ee89203
MD5 SHA1 SHA512

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.privateemail.com
Port
587
Username
[email protected]
Password
manofpeace123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\invoice pdf pdf pdf.exe\""	invoice pdf pdf pdf.exe

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1424-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1424-6-0x00000000004374FE-mapping.dmp	family_agenttesla
behavioral1/memory/1424-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1424-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	invoice pdf pdf pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	invoice pdf pdf pdf.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice pdf pdf pdf.exe	invoice pdf pdf pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice pdf pdf pdf.exe	invoice pdf pdf pdf.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\invoice pdf pdf pdf.exe"	invoice pdf pdf pdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\invoice pdf pdf pdf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\invoice pdf pdf pdf.exe"	invoice pdf pdf pdf.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.ipify.org
10	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	invoice pdf pdf pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	invoice pdf pdf pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 1424	1516	invoice pdf pdf pdf.exe	31

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1920	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	invoice pdf pdf pdf.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	invoice pdf pdf pdf.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1516	invoice pdf pdf pdf.exe
1424	invoice pdf pdf pdf.exe
1424	invoice pdf pdf pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	invoice pdf pdf pdf.exe
Token: SeDebugPrivilege	1424	invoice pdf pdf pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1424	invoice pdf pdf pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1920	1516	invoice pdf pdf pdf.exe	25
PID 1516 wrote to memory of 1920	1516	invoice pdf pdf pdf.exe	25
PID 1516 wrote to memory of 1920	1516	invoice pdf pdf pdf.exe	25
PID 1516 wrote to memory of 1920	1516	invoice pdf pdf pdf.exe	25
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31
PID 1516 wrote to memory of 1424	1516	invoice pdf pdf pdf.exe	31

C:\Users\Admin\AppData\Local\Temp\invoice pdf pdf pdf.exe
"C:\Users\Admin\AppData\Local\Temp\invoice pdf pdf pdf.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:1920
- C:\Users\Admin\AppData\Local\Temp\invoice pdf pdf pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\invoice pdf pdf pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1424