agenttesla | 38a768da182507828cb8951cae8b8a6cb9399e07c7eec2b680277d3c2cbc2ce3

Analysis

max time kernel
113s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
148f16cf98a9ce28e708fe0009733206.exe
Size 752KB
Sample201109-rrdbrx2vla
SHA256 38a768da182507828cb8951cae8b8a6cb9399e07c7eec2b680277d3c2cbc2ce3
MD5 148f16cf98a9ce28e708fe0009733206
SHA1 80f71c0324cad2ce2ca2da1e735a979bfaaecc8b
SHA512 083fbcfdacffbf3ba4da45791cd021c6c8863b301fd722c24b1c9fdefb1b8bd893671561beacc98ea8afa7dc683984abb476983cea81a654d84cebcf89184359
MD5 SHA1 SHA512

Score

10^/10

agenttesla agilenet keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/708-26-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/708-27-0x000000000044C89E-mapping.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

pid	Process
1428	microexe.exe
708	InstallUtil.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microexe.exe	148f16cf98a9ce28e708fe0009733206.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microexe.exe	148f16cf98a9ce28e708fe0009733206.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/916-3-0x00000000012C0000-0x00000000012CF000-memory.dmp	agile_net

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microexe = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\microexe.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1428 set thread context of 708	1428	microexe.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
916	148f16cf98a9ce28e708fe0009733206.exe
1428	microexe.exe
1428	microexe.exe
1428	microexe.exe
708	InstallUtil.exe
708	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	148f16cf98a9ce28e708fe0009733206.exe
Token: SeDebugPrivilege	1428	microexe.exe
Token: SeDebugPrivilege	708	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
708	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4052	916	148f16cf98a9ce28e708fe0009733206.exe	75
PID 916 wrote to memory of 4052	916	148f16cf98a9ce28e708fe0009733206.exe	75
PID 916 wrote to memory of 4052	916	148f16cf98a9ce28e708fe0009733206.exe	75
PID 4052 wrote to memory of 2780	4052	cmd.exe	77
PID 4052 wrote to memory of 2780	4052	cmd.exe	77
PID 4052 wrote to memory of 2780	4052	cmd.exe	77
PID 916 wrote to memory of 1428	916	148f16cf98a9ce28e708fe0009733206.exe	81
PID 916 wrote to memory of 1428	916	148f16cf98a9ce28e708fe0009733206.exe	81
PID 916 wrote to memory of 1428	916	148f16cf98a9ce28e708fe0009733206.exe	81
PID 1428 wrote to memory of 708	1428	microexe.exe	82
PID 1428 wrote to memory of 708	1428	microexe.exe	82
PID 1428 wrote to memory of 708	1428	microexe.exe	82
PID 1428 wrote to memory of 708	1428	microexe.exe	82
PID 1428 wrote to memory of 708	1428	microexe.exe	82
PID 1428 wrote to memory of 708	1428	microexe.exe	82
PID 1428 wrote to memory of 708	1428	microexe.exe	82
PID 1428 wrote to memory of 708	1428	microexe.exe	82
PID 708 wrote to memory of 2984	708	InstallUtil.exe	84
PID 708 wrote to memory of 2984	708	InstallUtil.exe	84
PID 708 wrote to memory of 2984	708	InstallUtil.exe	84

C:\Users\Admin\AppData\Local\Temp\148f16cf98a9ce28e708fe0009733206.exe
"C:\Users\Admin\AppData\Local\Temp\148f16cf98a9ce28e708fe0009733206.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Microexe /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microexe.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Microexe /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microexe.exe"
    3⤵
    - Adds Run key to start application
    PID:2780
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microexe.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:708
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" wlan show profile
      4⤵
      PID:2984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/708-34-0x0000000005390000-0x0000000005391000-memory.dmp

Download

memory/708-26-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/708-30-0x0000000073800000-0x0000000073EEE000-memory.dmp

Download

memory/708-35-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/708-39-0x0000000006950000-0x0000000006951000-memory.dmp

Download

memory/708-36-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

Download

memory/916-9-0x0000000005430000-0x0000000005432000-memory.dmp

Download

memory/916-5-0x00000000012F0000-0x00000000012F2000-memory.dmp

Download

memory/916-4-0x0000000005750000-0x0000000005751000-memory.dmp

Download

memory/916-8-0x00000000054C0000-0x00000000054C1000-memory.dmp

Download

memory/916-6-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/916-7-0x0000000005420000-0x0000000005422000-memory.dmp

Download

memory/916-3-0x00000000012C0000-0x00000000012CF000-memory.dmp

Download

memory/916-0-0x0000000073800000-0x0000000073EEE000-memory.dmp

Download

memory/916-1-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/1428-25-0x0000000006050000-0x0000000006051000-memory.dmp

Download

memory/1428-16-0x0000000073800000-0x0000000073EEE000-memory.dmp

Download