agenttesla | 6c87c4d4bb0afb52c271455df2c87d6c1f45168dae2cf999c1cd28f8a19199b3

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
20/01/2022, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
449fe744967d2c924fb1ec737187f976.exe
Size 436KB
Sample220120-kta12ahbf9
SHA256 6c87c4d4bb0afb52c271455df2c87d6c1f45168dae2cf999c1cd28f8a19199b3
MD5 449fe744967d2c924fb1ec737187f976
SHA1 0ab308680817b921cfe89a171f7b1923dc4eff67
SHA512 6d1aa64c370ed60dffd7ed9c8a24fb21b7514140db922a5e9cfeca3a17f7ffbc3a51a575c7fa43ef2263ed8e9e4493ec18c07db45124ec889145c58b8ad5148a
MD5 SHA1 SHA512

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

http://lab2e1.xyz//inc/741e7bb0442c85.php

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1792-140-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	449fe744967d2c924fb1ec737187f976.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	449fe744967d2c924fb1ec737187f976.exe
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	449fe744967d2c924fb1ec737187f976.exe
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	449fe744967d2c924fb1ec737187f976.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1960	schtasks.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1792	449fe744967d2c924fb1ec737187f976.exe
1792	449fe744967d2c924fb1ec737187f976.exe
1460	powershell.exe
1460	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	449fe744967d2c924fb1ec737187f976.exe
Token: SeDebugPrivilege	1460	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1792	449fe744967d2c924fb1ec737187f976.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1460	1912	449fe744967d2c924fb1ec737187f976.exe	61
PID 1912 wrote to memory of 1460	1912	449fe744967d2c924fb1ec737187f976.exe	61
PID 1912 wrote to memory of 1460	1912	449fe744967d2c924fb1ec737187f976.exe	61
PID 1912 wrote to memory of 1960	1912	449fe744967d2c924fb1ec737187f976.exe	63
PID 1912 wrote to memory of 1960	1912	449fe744967d2c924fb1ec737187f976.exe	63
PID 1912 wrote to memory of 1960	1912	449fe744967d2c924fb1ec737187f976.exe	63
PID 1912 wrote to memory of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65
PID 1912 wrote to memory of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65
PID 1912 wrote to memory of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65
PID 1912 wrote to memory of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65
PID 1912 wrote to memory of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65
PID 1912 wrote to memory of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65
PID 1912 wrote to memory of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65
PID 1912 wrote to memory of 1792	1912	449fe744967d2c924fb1ec737187f976.exe	65

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	449fe744967d2c924fb1ec737187f976.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	449fe744967d2c924fb1ec737187f976.exe

C:\Users\Admin\AppData\Local\Temp\449fe744967d2c924fb1ec737187f976.exe
"C:\Users\Admin\AppData\Local\Temp\449fe744967d2c924fb1ec737187f976.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kRZSRUYkHj.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kRZSRUYkHj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDCFB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\449fe744967d2c924fb1ec737187f976.exe
  "C:\Users\Admin\AppData\Local\Temp\449fe744967d2c924fb1ec737187f976.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:3944

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 982a5718b38ba88f835336bc0b0b1f9e m1LUVBdGck63P0D30X+vRQ.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-146-0x0000000004682000-0x0000000004683000-memory.dmp

Download

memory/1460-152-0x0000000008570000-0x000000000858E000-memory.dmp

Download

memory/1460-160-0x0000000009670000-0x0000000009678000-memory.dmp

Download

memory/1460-159-0x0000000009690000-0x00000000096AA000-memory.dmp

Download

memory/1460-158-0x0000000009580000-0x000000000958E000-memory.dmp

Download

memory/1460-157-0x00000000095D0000-0x0000000009666000-memory.dmp

Download

memory/1460-139-0x0000000004690000-0x00000000046C6000-memory.dmp

Download

memory/1460-156-0x00000000093C0000-0x00000000093CA000-memory.dmp

Download

memory/1460-141-0x0000000007370000-0x0000000007998000-memory.dmp

Download

memory/1460-142-0x0000000006FE0000-0x0000000007002000-memory.dmp

Download

memory/1460-143-0x0000000007280000-0x00000000072E6000-memory.dmp

Download

memory/1460-144-0x00000000072F0000-0x0000000007356000-memory.dmp

Download

memory/1460-145-0x0000000004680000-0x0000000004681000-memory.dmp

Download

memory/1460-155-0x00000000092E0000-0x00000000092FA000-memory.dmp

Download

memory/1460-154-0x00000000099A0000-0x000000000A01A000-memory.dmp

Download

memory/1460-149-0x0000000004685000-0x0000000004687000-memory.dmp

Download

memory/1460-153-0x000000007F110000-0x000000007F111000-memory.dmp

Download

memory/1460-150-0x0000000008590000-0x00000000085C2000-memory.dmp

Download

memory/1460-151-0x00000000703A0000-0x00000000703EC000-memory.dmp

Download

memory/1460-148-0x0000000006D40000-0x0000000006D5E000-memory.dmp

Download

memory/1792-147-0x0000000004E10000-0x00000000053B4000-memory.dmp

Download

memory/1792-140-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1792-162-0x0000000005EF0000-0x0000000005F40000-memory.dmp

Download

memory/1912-132-0x0000000005800000-0x0000000005892000-memory.dmp

Download

memory/1912-130-0x0000000000D70000-0x0000000000DE4000-memory.dmp

Download

memory/1912-131-0x0000000005DB0000-0x0000000006354000-memory.dmp

Download

memory/1912-135-0x0000000007FF0000-0x000000000808C000-memory.dmp

Download

memory/1912-134-0x00000000056E0000-0x0000000005772000-memory.dmp

Download

memory/1912-133-0x00000000057A0000-0x00000000057AA000-memory.dmp

Download