agenttesla | 15637f2d530662c968272c1e6e48ca6a093f0c828edf0cbb5cd32d9af03b3ff5

General

Target

tmp/.winlogon.exe
Size

462KB
MD5

629f5bb8b5ee75e90c393ad9d96a1772
SHA1

b09925a7163bef858657a1b39146fe27abb01f99
SHA256

15637f2d530662c968272c1e6e48ca6a093f0c828edf0cbb5cd32d9af03b3ff5
SHA512

3434c0b1f42533c42a4232809a007ddfd340ebc0d500db436cd038e3d3b4aaf0fd8bcf36e3a1cee4442c5d894679f5cdc7cef5a90c04534f937121d6cc9e3857

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.stockmeieir.com
Port:
587
Username:
m.melendez@stockmeieir.com
Password:
aU6sb@#1%Efh

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2832-135-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2832-136-0x00000000004374EE-mapping.dmp	family_agenttesla
behavioral2/memory/2832-147-0x0000000005780000-0x0000000005C7E000-memory.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

.winlogon.exe

description pid process target process

PID 2668 set thread context of 2832 2668 .winlogon.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

984 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

.winlogon.exepowershell.exeRegSvcs.exe

pid process

2668 .winlogon.exe
2668 .winlogon.exe
4040 powershell.exe
2832 RegSvcs.exe
2832 RegSvcs.exe
4040 powershell.exe
4040 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

.winlogon.exepowershell.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 2668 .winlogon.exe
Token: SeDebugPrivilege 4040 powershell.exe
Token: SeDebugPrivilege 2832 RegSvcs.exe

description	pid	process	target process
PID 2668 set thread context of 2832	2668	.winlogon.exe	RegSvcs.exe

pid	process
984	schtasks.exe

pid	process
2668	.winlogon.exe
2668	.winlogon.exe
4040	powershell.exe
2832	RegSvcs.exe
2832	RegSvcs.exe
4040	powershell.exe
4040	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2668	.winlogon.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	2832	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

.winlogon.exe

description	pid	process	target process
PID 2668 wrote to memory of 4040	2668	.winlogon.exe	powershell.exe
PID 2668 wrote to memory of 4040	2668	.winlogon.exe	powershell.exe
PID 2668 wrote to memory of 4040	2668	.winlogon.exe	powershell.exe
PID 2668 wrote to memory of 984	2668	.winlogon.exe	schtasks.exe
PID 2668 wrote to memory of 984	2668	.winlogon.exe	schtasks.exe
PID 2668 wrote to memory of 984	2668	.winlogon.exe	schtasks.exe
PID 2668 wrote to memory of 2832	2668	.winlogon.exe	RegSvcs.exe
PID 2668 wrote to memory of 2832	2668	.winlogon.exe	RegSvcs.exe
PID 2668 wrote to memory of 2832	2668	.winlogon.exe	RegSvcs.exe
PID 2668 wrote to memory of 2832	2668	.winlogon.exe	RegSvcs.exe
PID 2668 wrote to memory of 2832	2668	.winlogon.exe	RegSvcs.exe
PID 2668 wrote to memory of 2832	2668	.winlogon.exe	RegSvcs.exe
PID 2668 wrote to memory of 2832	2668	.winlogon.exe	RegSvcs.exe
PID 2668 wrote to memory of 2832	2668	.winlogon.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\tmp\.winlogon.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\.winlogon.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UlhpAjSuVoTa.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UlhpAjSuVoTa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6492.tmp"
2⤵
- Creates scheduled task(s)
PID:984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6492.tmp
MD5
dc91878680b976aefadcd721c51499be

SHA1
6b14ee5b275759b59d9cb2431e0d4f4c18937391

SHA256
dcf6415c2148a97e901e94f2992733aefbce1f2c4879a831e1ab5e6127cd205c

SHA512
fff97d17b396cfc39c1614f2654b0e7b9c8b3605b9d700a0c95a7865d75e4e6f0c17bb212aebf5dc0050c634c58fc98a33203dee3f7711b326d814b8fa201387

Download Submit
memory/984-129-0x0000000000000000-mapping.dmp

Download
memory/2668-125-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/2668-122-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/2668-123-0x0000000004C90000-0x0000000004D22000-memory.dmp

Filesize
584KB

Download
memory/2668-124-0x0000000005180000-0x0000000005188000-memory.dmp

Filesize
32KB

Download
memory/2668-126-0x0000000005B50000-0x0000000005B51000-memory.dmp

Filesize
4KB

Download
memory/2668-127-0x0000000005CF0000-0x0000000005D59000-memory.dmp

Filesize
420KB

Download
memory/2668-121-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/2668-118-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2668-120-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/2832-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2832-391-0x0000000005780000-0x0000000005C7E000-memory.dmp

Filesize
5.0MB

Download
memory/2832-147-0x0000000005780000-0x0000000005C7E000-memory.dmp

Filesize
5.0MB

Download
memory/2832-136-0x00000000004374EE-mapping.dmp

Download
memory/4040-140-0x0000000007860000-0x0000000007861000-memory.dmp

Filesize
4KB

Download
memory/4040-149-0x00000000087B0000-0x00000000087B1000-memory.dmp

Filesize
4KB

Download
memory/4040-133-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/4040-131-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/4040-141-0x0000000008170000-0x0000000008171000-memory.dmp

Filesize
4KB

Download
memory/4040-143-0x00000000081E0000-0x00000000081E1000-memory.dmp

Filesize
4KB

Download
memory/4040-144-0x0000000008250000-0x0000000008251000-memory.dmp

Filesize
4KB

Download
memory/4040-145-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/4040-146-0x0000000004DB2000-0x0000000004DB3000-memory.dmp

Filesize
4KB

Download
memory/4040-130-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/4040-148-0x0000000008050000-0x0000000008051000-memory.dmp

Filesize
4KB

Download
memory/4040-134-0x0000000007960000-0x0000000007961000-memory.dmp

Filesize
4KB

Download
memory/4040-150-0x0000000008950000-0x0000000008951000-memory.dmp

Filesize
4KB

Download
memory/4040-151-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/4040-158-0x00000000098E0000-0x0000000009913000-memory.dmp

Filesize
204KB

Download
memory/4040-165-0x00000000098A0000-0x00000000098A1000-memory.dmp

Filesize
4KB

Download
memory/4040-170-0x0000000009A10000-0x0000000009A11000-memory.dmp

Filesize
4KB

Download
memory/4040-171-0x0000000009BE0000-0x0000000009BE1000-memory.dmp

Filesize
4KB

Download
memory/4040-172-0x000000007F680000-0x000000007F681000-memory.dmp

Filesize
4KB

Download
memory/4040-173-0x0000000004DB3000-0x0000000004DB4000-memory.dmp

Filesize
4KB

Download
memory/4040-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads