agenttesla | b28f9a7f96b064ebc4ea9076e9dbaabce7387ef2a38944fcab534dc65e88d050

General

Target

Ningbo shipping statement for March 2021.exe
Size

816KB
MD5

840a47d9bf5168dd2f452b86294bc9da
SHA1

36814de1a82ae89739b26b0edb90abf41ca867cb
SHA256

b28f9a7f96b064ebc4ea9076e9dbaabce7387ef2a38944fcab534dc65e88d050
SHA512

bb54779bcfbfe88de1bcc6e4407087184c8910462f808275c2c46ef8350b60d437ef9fafec574317c40590af7c81d2e96f823a9d48aa17b7b964eae82b6767a0

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
webmail.mdist.us
Port:
587
Username:
[email protected]
Password:
pos#4321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2116-126-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2116-127-0x000000000043781E-mapping.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppptOL = "C:\\Users\\Admin\\AppData\\Roaming\\ppptOL\\ppptOL.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Ningbo shipping statement for March 2021.exe

description pid process target process

PID 3972 set thread context of 2116 3972 Ningbo shipping statement for March 2021.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3692 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Ningbo shipping statement for March 2021.exeRegSvcs.exe

pid process

3972 Ningbo shipping statement for March 2021.exe
2116 RegSvcs.exe
2116 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Ningbo shipping statement for March 2021.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 3972 Ningbo shipping statement for March 2021.exe
Token: SeDebugPrivilege 2116 RegSvcs.exe

description	pid	process	target process
PID 3972 set thread context of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe

pid	process
3692	schtasks.exe

pid	process
3972	Ningbo shipping statement for March 2021.exe
2116	RegSvcs.exe
2116	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3972	Ningbo shipping statement for March 2021.exe
Token: SeDebugPrivilege	2116	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Ningbo shipping statement for March 2021.exe

description	pid	process	target process
PID 3972 wrote to memory of 3692	3972	Ningbo shipping statement for March 2021.exe	schtasks.exe
PID 3972 wrote to memory of 3692	3972	Ningbo shipping statement for March 2021.exe	schtasks.exe
PID 3972 wrote to memory of 3692	3972	Ningbo shipping statement for March 2021.exe	schtasks.exe
PID 3972 wrote to memory of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe
PID 3972 wrote to memory of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe
PID 3972 wrote to memory of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe
PID 3972 wrote to memory of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe
PID 3972 wrote to memory of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe
PID 3972 wrote to memory of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe
PID 3972 wrote to memory of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe
PID 3972 wrote to memory of 2116	3972	Ningbo shipping statement for March 2021.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Ningbo shipping statement for March 2021.exe
"C:\Users\Admin\AppData\Local\Temp\Ningbo shipping statement for March 2021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sSSqcGV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA56D.tmp"
2⤵
- Creates scheduled task(s)
PID:3692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA56D.tmp
MD5
be5e2566155b4097f47b770a22b93fde

SHA1
79939bf80ffa6e8a5d5517569ac47964a41cec74

SHA256
f825f6b28b6492a02d156cd9326088d2f8da6664f801fff89a50a5ec259887a4

SHA512
992efd75c3b555048238a5ddccc163ceda791edaeecb3847daac2a3b99d49066b6d9b55171233b2e139ef02785e7ae88bd7c43923ef93f4e2ecbb8683635b951

Download Submit
memory/2116-137-0x0000000004FB1000-0x0000000004FB2000-memory.dmp

Filesize
4KB

Download
memory/2116-134-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

Filesize
4KB

Download
memory/2116-133-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/2116-132-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/2116-127-0x000000000043781E-mapping.dmp

Download
memory/2116-126-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3692-124-0x0000000000000000-mapping.dmp

Download
memory/3972-119-0x00000000089C0000-0x00000000089C1000-memory.dmp

Filesize
4KB

Download
memory/3972-123-0x000000000C290000-0x000000000C2F8000-memory.dmp

Filesize
416KB

Download
memory/3972-122-0x0000000009D00000-0x0000000009DA2000-memory.dmp

Filesize
648KB

Download
memory/3972-121-0x0000000005F30000-0x0000000005F35000-memory.dmp

Filesize
20KB

Download
memory/3972-120-0x0000000005360000-0x000000000585E000-memory.dmp

Filesize
5.0MB

Download
memory/3972-114-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/3972-118-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/3972-117-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/3972-116-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads