agenttesla | 19ea70b85d1e0c5c9c9ebb1f2412ee14b363da45f5ba68f7f8ea217fe6dcb975

Analysis

max time kernel
169s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
03/02/2022, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
Size 582KB
Sample220203-jvf31aeddj
SHA256 19ea70b85d1e0c5c9c9ebb1f2412ee14b363da45f5ba68f7f8ea217fe6dcb975
MD5 0745767293956ba51033b66ef17416c7
SHA1 94047f5eceea355cde7b817881fad487c68a62f8
SHA512 e7104cb971fd5a898fb7a77e816fba99b3daf6ca5932b4600c502bd46906a498c9f0411b52c98e60ed733f723e2a6f9e6619f7e12bed580e32e84448ef7076ab
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.kenqarff.com
Port
587
Username
[email protected]
Password
rr^Pa#PIW5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3000-264-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 404 set thread context of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
924	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.126461"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132885252559894088"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
3000	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
3000	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
2960	powershell.exe
2960	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3000	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	3000	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2960	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	67
PID 404 wrote to memory of 2960	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	67
PID 404 wrote to memory of 2960	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	67
PID 404 wrote to memory of 924	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	69
PID 404 wrote to memory of 924	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	69
PID 404 wrote to memory of 924	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	69
PID 404 wrote to memory of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71
PID 404 wrote to memory of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71
PID 404 wrote to memory of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71
PID 404 wrote to memory of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71
PID 404 wrote to memory of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71
PID 404 wrote to memory of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71
PID 404 wrote to memory of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71
PID 404 wrote to memory of 3000	404	BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe	71

C:\Users\Admin\AppData\Local\Temp\BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
"C:\Users\Admin\AppData\Local\Temp\BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PZLTSBwK.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PZLTSBwK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB876.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:924
- C:\Users\Admin\AppData\Local\Temp\BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\BL-018907-DKAEQU7EMEZSG1O-0972-PDF.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3000

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1932

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 24ecb12d14261ba8be94d44ee36cb5de Ta51Ud/YR0CH6/Xm9He1iQ.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:3024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/404-131-0x00000000055F0000-0x00000000055F1000-memory.dmp

Download

memory/404-132-0x00000000058C0000-0x0000000005900000-memory.dmp

Download

memory/404-133-0x0000000005A90000-0x0000000005B22000-memory.dmp

Download

memory/404-255-0x0000000005B30000-0x0000000005BCC000-memory.dmp

Download

memory/404-256-0x00000000055F3000-0x00000000055F5000-memory.dmp

Download

memory/404-257-0x0000000006650000-0x0000000006BF4000-memory.dmp

Download

memory/404-130-0x0000000000BE0000-0x0000000000C78000-memory.dmp

Download

memory/2960-267-0x00000000081A0000-0x00000000081C2000-memory.dmp

Download

memory/2960-272-0x0000000008FF0000-0x0000000009022000-memory.dmp

Download

memory/2960-262-0x00000000050F0000-0x00000000050F1000-memory.dmp

Download

memory/2960-282-0x000000000A050000-0x000000000A058000-memory.dmp

Download

memory/2960-265-0x0000000007AB0000-0x00000000080D8000-memory.dmp

Download

memory/2960-281-0x000000000A070000-0x000000000A08A000-memory.dmp

Download

memory/2960-260-0x0000000005080000-0x00000000050B6000-memory.dmp

Download

memory/2960-268-0x00000000081D0000-0x0000000008236000-memory.dmp

Download

memory/2960-269-0x0000000008370000-0x00000000083D6000-memory.dmp

Download

memory/2960-270-0x0000000008990000-0x00000000089AE000-memory.dmp

Download

memory/2960-271-0x00000000050F5000-0x00000000050F7000-memory.dmp

Download

memory/2960-263-0x00000000050F2000-0x00000000050F3000-memory.dmp

Download

memory/2960-273-0x0000000071180000-0x00000000711CC000-memory.dmp

Download

memory/2960-274-0x0000000008EA0000-0x0000000008EBE000-memory.dmp

Download

memory/2960-275-0x000000007EFB0000-0x000000007EFB1000-memory.dmp

Download

memory/2960-276-0x000000000A3C0000-0x000000000AA3A000-memory.dmp

Download

memory/2960-277-0x0000000009D40000-0x0000000009D5A000-memory.dmp

Download

memory/2960-278-0x0000000009DA0000-0x0000000009DAA000-memory.dmp

Download

memory/2960-279-0x0000000009F90000-0x000000000A026000-memory.dmp

Download

memory/2960-280-0x0000000009D80000-0x0000000009D8E000-memory.dmp

Download

memory/3000-266-0x0000000005620000-0x0000000005BC4000-memory.dmp

Download

memory/3000-264-0x0000000000400000-0x000000000043C000-memory.dmp

Download