agenttesla | 802f77b9123b032ae100bc645544b8fb46656d23b6d7dffc3e8e92c2b1d892e0

General

Target
BANK DETAILSINCORRECT IBAN.exe
Size 572KB
Sample220325-vvbztsaef3
SHA256 802f77b9123b032ae100bc645544b8fb46656d23b6d7dffc3e8e92c2b1d892e0
MD5 b9250fa203c2e23edd10cd227b1e8b3d
SHA1 337b5af5ba10b4e0ecbd9541c0609b5e77c8ff38
SHA512 1e4390d718ad1f1cd66e5e23d528dfb91334d3ffbf0fc14346875554c18d0944a7db5b472b15257e5406171c7164b42e7beb11d3ae08c8919f1e3822a30ccff0
MD5 SHA1 SHA512

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.casual.com.pk
Port
587
Username
[email protected]
Password
Pass97WORD#@#

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.casual.com.pk
Port
587
Username
[email protected]
Password
Pass97WORD#@#

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	BANK DETAILSINCORRECT IBAN.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BANK DETAILSINCORRECT IBAN.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BANK DETAILSINCORRECT IBAN.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BANK DETAILSINCORRECT IBAN.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3556	BANK DETAILSINCORRECT IBAN.exe
3556	BANK DETAILSINCORRECT IBAN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	BANK DETAILSINCORRECT IBAN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3556	BANK DETAILSINCORRECT IBAN.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4372	1684	BANK DETAILSINCORRECT IBAN.exe	86
PID 1684 wrote to memory of 4372	1684	BANK DETAILSINCORRECT IBAN.exe	86
PID 1684 wrote to memory of 4372	1684	BANK DETAILSINCORRECT IBAN.exe	86
PID 1684 wrote to memory of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88
PID 1684 wrote to memory of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88
PID 1684 wrote to memory of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88
PID 1684 wrote to memory of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88
PID 1684 wrote to memory of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88
PID 1684 wrote to memory of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88
PID 1684 wrote to memory of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88
PID 1684 wrote to memory of 3556	1684	BANK DETAILSINCORRECT IBAN.exe	88

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BANK DETAILSINCORRECT IBAN.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BANK DETAILSINCORRECT IBAN.exe

C:\Users\Admin\AppData\Local\Temp\BANK DETAILSINCORRECT IBAN.exe
"C:\Users\Admin\AppData\Local\Temp\BANK DETAILSINCORRECT IBAN.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BGpHQPtJN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB9A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4372
- C:\Users\Admin\AppData\Local\Temp\BANK DETAILSINCORRECT IBAN.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:3556