agenttesla | 8174806d6bbe5f5c713a2a860c36b22d3efe8c7effeb0284bb23de5a9fe68d26

General

Target

Product List.exe
Size

564KB
MD5

df1a8e7ffa630db4a9fa38abaec4c0d2
SHA1

19077607d6f6951499783faec6f1722cb9b2c077
SHA256

8174806d6bbe5f5c713a2a860c36b22d3efe8c7effeb0284bb23de5a9fe68d26
SHA512

7e7c2e8d94afae614291a9add08ee21ec1d0045ed30f0912a1572aa0d4090a214de0ac669cdb0f87a7bba35e9ca82fd5aaabe88871c1f5567ba2c3fb26262973

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
at.engineering
Port:
587
Username:
kristle@at.engineering
Password:
ATE@2019

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1492-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1492-11-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral1/memory/1492-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Product List.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Product List.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Product List.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Product List.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Product List.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Product List.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Product List.exe

description pid process target process

PID 2028 set thread context of 1492 2028 Product List.exe Product List.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1512 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Product List.exeProduct List.exe

pid process

2028 Product List.exe
1492 Product List.exe
1492 Product List.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Product List.exeProduct List.exe

description pid process

Token: SeDebugPrivilege 2028 Product List.exe
Token: SeDebugPrivilege 1492 Product List.exe

description	pid	process	target process
PID 2028 set thread context of 1492	2028	Product List.exe	Product List.exe

pid	process
1512	schtasks.exe

pid	process
2028	Product List.exe
1492	Product List.exe
1492	Product List.exe

description	pid	process
Token: SeDebugPrivilege	2028	Product List.exe
Token: SeDebugPrivilege	1492	Product List.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Product List.exe

description	pid	process	target process
PID 2028 wrote to memory of 1512	2028	Product List.exe	schtasks.exe
PID 2028 wrote to memory of 1512	2028	Product List.exe	schtasks.exe
PID 2028 wrote to memory of 1512	2028	Product List.exe	schtasks.exe
PID 2028 wrote to memory of 1512	2028	Product List.exe	schtasks.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe
PID 2028 wrote to memory of 1492	2028	Product List.exe	Product List.exe

C:\Users\Admin\AppData\Local\Temp\Product List.exe
"C:\Users\Admin\AppData\Local\Temp\Product List.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oObXLwwKgq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA43B.tmp"
2⤵
- Creates scheduled task(s)
PID:1512

C:\Users\Admin\AppData\Local\Temp\Product List.exe
"C:\Users\Admin\AppData\Local\Temp\Product List.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA43B.tmp
MD5
0de6baea016980e8f2bf9f73864298fe

SHA1
5be63e566e8bf624d1dac63075d779f1ec8fba82

SHA256
abe7c26f8a17143da5b47089249ba11cb69817656303c8be817f4a368820f474

SHA512
c49eccf8f70d511a21951d3a623e3eadc81e96d0ca878fbe477006c0dcc7812223fb013838366996f1cda87a8d153d76c15268a0b987542859bf712c0857864f

Download Submit
memory/1492-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1492-11-0x00000000004375EE-mapping.dmp

Download
memory/1492-12-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/1492-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1492-15-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/1512-8-0x0000000000000000-mapping.dmp

Download
memory/2028-2-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/2028-3-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/2028-5-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/2028-6-0x00000000008D0000-0x00000000008D3000-memory.dmp

Filesize
12KB

Download
memory/2028-7-0x0000000004FB0000-0x000000000500E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads