agenttesla | a22ca2c5d6086e8c6703deb2e345efc08627e7063c447d60babe6edb17503856

General

Target

Halkbank.exe
Size

604KB
MD5

4b230a305cc22a04446b397310070d56
SHA1

208524b096c579b89579febff0b40f752b4e7db4
SHA256

a22ca2c5d6086e8c6703deb2e345efc08627e7063c447d60babe6edb17503856
SHA512

c0dcfea90b46ef91463d6ff272e0febd9ee5615bad9f84993458bde3f9f7983fe025747b7a6e306b31884bc57f10040b965d4578900138721b519dcd37da4f95

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.devmetsan.com.tr
Port:
587
Username:
info@devmetsan.com.tr
Password:
Murat2019*

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1992-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1992-66-0x0000000000436F2E-mapping.dmp	family_agenttesla
behavioral1/memory/1992-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1992-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Halkbank.exe

description pid process target process

PID 1268 set thread context of 1992 1268 Halkbank.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1004 1992 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

RegSvcs.exeWerFault.exe

pid process

1992 RegSvcs.exe
1992 RegSvcs.exe
1004 WerFault.exe
1004 WerFault.exe
1004 WerFault.exe
1004 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegSvcs.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1992 RegSvcs.exe
Token: SeDebugPrivilege 1004 WerFault.exe

description	pid	process	target process
PID 1268 set thread context of 1992	1268	Halkbank.exe	RegSvcs.exe

pid	pid_target	process	target process
1004	1992	WerFault.exe	RegSvcs.exe

pid	process
1992	RegSvcs.exe
1992	RegSvcs.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1992	RegSvcs.exe
Token: SeDebugPrivilege	1004	WerFault.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Halkbank.exeRegSvcs.exe

description	pid	process	target process
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1268 wrote to memory of 1992	1268	Halkbank.exe	RegSvcs.exe
PID 1992 wrote to memory of 1004	1992	RegSvcs.exe	WerFault.exe
PID 1992 wrote to memory of 1004	1992	RegSvcs.exe	WerFault.exe
PID 1992 wrote to memory of 1004	1992	RegSvcs.exe	WerFault.exe
PID 1992 wrote to memory of 1004	1992	RegSvcs.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Halkbank.exe
"C:\Users\Admin\AppData\Local\Temp\Halkbank.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 1016
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-70-0x0000000000000000-mapping.dmp

Download
memory/1004-71-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1268-57-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1268-58-0x00000000004B0000-0x00000000004B8000-memory.dmp

Filesize
32KB

Download
memory/1268-59-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/1268-60-0x0000000004FD0000-0x000000000503A000-memory.dmp

Filesize
424KB

Download
memory/1268-55-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1992-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-66-0x0000000000436F2E-mapping.dmp

Download
memory/1992-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-69-0x00000000049E0000-0x00000000049E1000-memory.dmp

Filesize
4KB

Download
memory/1992-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads