agenttesla | 264b1ca9df86f0d722b98b6aebc1be86d4c342747b709113a4eca4d68fc0dbdc

General

Target

DHL Delivery Invoice.pdf.exe
Size

576KB
MD5

1c8452d15051907d3bc10de6ae00220f
SHA1

22f840194dd125a4f416c9cf4f2daff13b0fcfc7
SHA256

264b1ca9df86f0d722b98b6aebc1be86d4c342747b709113a4eca4d68fc0dbdc
SHA512

ad72f89ea67b42268c5c43e3417bb8f179607743b68ca0f358306f2183a76cebff53153ef811b1f7f583a346af507d0cb9757bcccf64eb5858ed9d473d30d14e

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
marcellinus360

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2852-135-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2852-136-0x000000000043761E-mapping.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL Delivery Invoice.pdf.exe

description pid process target process

PID 3680 set thread context of 2852 3680 DHL Delivery Invoice.pdf.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

804 schtasks.exe

description	pid	process	target process
PID 3680 set thread context of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe

pid	process
804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

DHL Delivery Invoice.pdf.exepowershell.exeRegSvcs.exe

pid	process
3680	DHL Delivery Invoice.pdf.exe
3680	DHL Delivery Invoice.pdf.exe
508	powershell.exe
2852	RegSvcs.exe
2852	RegSvcs.exe
508	powershell.exe
508	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL Delivery Invoice.pdf.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3680	DHL Delivery Invoice.pdf.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeDebugPrivilege	2852	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

2852 RegSvcs.exe

pid	process
2852	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

DHL Delivery Invoice.pdf.exe

description	pid	process	target process
PID 3680 wrote to memory of 508	3680	DHL Delivery Invoice.pdf.exe	powershell.exe
PID 3680 wrote to memory of 508	3680	DHL Delivery Invoice.pdf.exe	powershell.exe
PID 3680 wrote to memory of 508	3680	DHL Delivery Invoice.pdf.exe	powershell.exe
PID 3680 wrote to memory of 804	3680	DHL Delivery Invoice.pdf.exe	schtasks.exe
PID 3680 wrote to memory of 804	3680	DHL Delivery Invoice.pdf.exe	schtasks.exe
PID 3680 wrote to memory of 804	3680	DHL Delivery Invoice.pdf.exe	schtasks.exe
PID 3680 wrote to memory of 3996	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 3996	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 3996	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe
PID 3680 wrote to memory of 2852	3680	DHL Delivery Invoice.pdf.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NaBFSpgH.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:508

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NaBFSpgH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50BC.tmp"
2⤵
- Creates scheduled task(s)
PID:804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:3996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp50BC.tmp
MD5
4083322cab1922c5b937b9067bf047e5

SHA1
2de2709dd1139e596e9abd439ae4ef0f1c84bfe0

SHA256
04ea79333809d1153c296556ff0d1334adf7af1e471cc9561cbac7abe3a0914e

SHA512
e0e649d0279c070e833f1a64dc5770ee82eab74435cc8389094a3f73e54513396d630cde6e9e8f090386005e9c0aa82a66c27221e669a8de461302cf9dd57be3

Download Submit
memory/508-140-0x0000000007D00000-0x0000000007D01000-memory.dmp

Filesize
4KB

Download
memory/508-131-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/508-172-0x0000000004CE3000-0x0000000004CE4000-memory.dmp

Filesize
4KB

Download
memory/508-171-0x000000007F3F0000-0x000000007F3F1000-memory.dmp

Filesize
4KB

Download
memory/508-170-0x0000000009870000-0x0000000009871000-memory.dmp

Filesize
4KB

Download
memory/508-142-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/508-165-0x0000000009700000-0x0000000009701000-memory.dmp

Filesize
4KB

Download
memory/508-158-0x0000000009740000-0x0000000009773000-memory.dmp

Filesize
204KB

Download
memory/508-128-0x0000000000000000-mapping.dmp

Download
memory/508-151-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/508-130-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/508-145-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/508-150-0x00000000086C0000-0x00000000086C1000-memory.dmp

Filesize
4KB

Download
memory/508-133-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/508-134-0x00000000076D0000-0x00000000076D1000-memory.dmp

Filesize
4KB

Download
memory/508-149-0x00000000088E0000-0x00000000088E1000-memory.dmp

Filesize
4KB

Download
memory/508-173-0x0000000009A70000-0x0000000009A71000-memory.dmp

Filesize
4KB

Download
memory/508-148-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

Filesize
4KB

Download
memory/508-146-0x0000000004CE2000-0x0000000004CE3000-memory.dmp

Filesize
4KB

Download
memory/508-143-0x0000000007E10000-0x0000000007E11000-memory.dmp

Filesize
4KB

Download
memory/508-144-0x00000000080A0000-0x00000000080A1000-memory.dmp

Filesize
4KB

Download
memory/804-129-0x0000000000000000-mapping.dmp

Download
memory/2852-136-0x000000000043761E-mapping.dmp

Download
memory/2852-147-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/2852-391-0x0000000002E51000-0x0000000002E52000-memory.dmp

Filesize
4KB

Download
memory/2852-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3680-127-0x0000000006960000-0x00000000069C9000-memory.dmp

Filesize
420KB

Download
memory/3680-121-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/3680-125-0x0000000006550000-0x0000000006551000-memory.dmp

Filesize
4KB

Download
memory/3680-126-0x0000000005B70000-0x0000000005B76000-memory.dmp

Filesize
24KB

Download
memory/3680-124-0x0000000005C40000-0x0000000005CB6000-memory.dmp

Filesize
472KB

Download
memory/3680-118-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/3680-122-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/3680-120-0x0000000005E30000-0x0000000005E31000-memory.dmp

Filesize
4KB

Download
memory/3680-123-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads