agenttesla | abffc06bc8ef92890372152d4a281c82183c34d5be27ee128f7920c0cbfc705a

General

Target
Payment Slip.exe
Size 600KB
Sample211221-bndejacbb7
SHA256 abffc06bc8ef92890372152d4a281c82183c34d5be27ee128f7920c0cbfc705a
MD5 609a9c4c60ee3c44bce3a266dc70c5d4
SHA1 0cc86a0492f78a9176876bf95cf33037129a1a7f
SHA512 5fdc0bf81af2f6d04132cc6dcc049a58d4600068368ac9d44ee0c3704eb8ca394f6adc63675cc13e07b50d1faff136f55e67dc54bb3a0fa2b19dc3c8efa32af0
MD5 SHA1 SHA512

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5082673869:AAHPx348yCyfnI9U-mY2fUJHGS4Mz9ftnQA/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/760-56-0x0000000000400000-0x000000000044B000-memory.dmp	family_agenttesla
behavioral1/memory/760-57-0x000000000040188B-mapping.dmp	family_agenttesla
behavioral1/memory/760-59-0x0000000000400000-0x000000000044B000-memory.dmp	family_agenttesla
behavioral1/memory/760-60-0x0000000001EA0000-0x0000000001ED6000-memory.dmp	family_agenttesla

Loads dropped DLL 1 IoCs

pid	Process
740	Payment Slip.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Slip.exe
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Slip.exe
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Slip.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 740 set thread context of 760	740	Payment Slip.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
760	Payment Slip.exe
760	Payment Slip.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	Payment Slip.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27
PID 740 wrote to memory of 760	740	Payment Slip.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Slip.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment Slip.exe

C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-54-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/760-56-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/760-59-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/760-60-0x0000000001EA0000-0x0000000001ED6000-memory.dmp

Download

memory/760-63-0x00000000044E2000-0x00000000044E3000-memory.dmp

Download

memory/760-62-0x00000000044E1000-0x00000000044E2000-memory.dmp

Download

memory/760-65-0x00000000044E4000-0x00000000044E5000-memory.dmp

Download

memory/760-64-0x00000000044E3000-0x00000000044E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads