agenttesla | 34d6009b5bb206cc478e1c18446985603ee853e33998188ee7cd23238cd2df59

General

Target

GS_ PO NO.1862021.exe
Size

559KB
MD5

65f5b048052a74a121ce54a75492374f
SHA1

e5bb9d25809a7e30ac97da1279e67ea7e44074d6
SHA256

e9fe2d375a2cddb31ca744190586f24d38b86f0fcbf9228ab6083c6763e71928
SHA512

83b2239384592c9aae95d3c6a3aa7de02fc2966f1a3c75dd599f29eea94558f42eac3df2f6e6d29370a18060aa432e04f16d933a7718450b4977d4a0db3e2182

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.odessabd.com
Port:
587
Username:
compliance2@odessabd.com
Password:
abc321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1660-11-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/1660-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1660-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvrzbM = "C:\\Users\\Admin\\AppData\\Roaming\\AvrzbM\\AvrzbM.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

GS_ PO NO.1862021.exe

description pid process target process

PID 1596 set thread context of 1660 1596 GS_ PO NO.1862021.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

GS_ PO NO.1862021.exeRegSvcs.exe

pid process

1596 GS_ PO NO.1862021.exe
1596 GS_ PO NO.1862021.exe
1596 GS_ PO NO.1862021.exe
1660 RegSvcs.exe
1660 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

GS_ PO NO.1862021.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1596 GS_ PO NO.1862021.exe
Token: SeDebugPrivilege 1660 RegSvcs.exe

description	pid	process	target process
PID 1596 set thread context of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe

pid	process
1596	GS_ PO NO.1862021.exe
1596	GS_ PO NO.1862021.exe
1596	GS_ PO NO.1862021.exe
1660	RegSvcs.exe
1660	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1596	GS_ PO NO.1862021.exe
Token: SeDebugPrivilege	1660	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

GS_ PO NO.1862021.exe

description	pid	process	target process
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe
PID 1596 wrote to memory of 1660	1596	GS_ PO NO.1862021.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\GS_ PO NO.1862021.exe
"C:\Users\Admin\AppData\Local\Temp\GS_ PO NO.1862021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-2-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1596-3-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/1596-5-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/1596-6-0x0000000000520000-0x0000000000524000-memory.dmp

Filesize
16KB

Download
memory/1596-7-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1596-8-0x0000000004700000-0x0000000004777000-memory.dmp

Filesize
476KB

Download
memory/1596-9-0x0000000001F40000-0x0000000001F7B000-memory.dmp

Filesize
236KB

Download
memory/1660-11-0x000000000043760E-mapping.dmp

Download
memory/1660-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1660-12-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1660-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1660-15-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads