agenttesla | d833eeb21faf05fd282e116c89ca50f383c96afbff0b350b88612de63a11f272

General

Target

Po129834589.exe
Size

743KB
MD5

7f90e73a8d12d33684f6d254c3d84ea6
SHA1

3ebaacc513549648b86fa343adbfb1cb53d60144
SHA256

5cc60b79a462acba33bafc299e15f4b0e8f75a96944f2dd3dd0836cb305bd889
SHA512

aa0faa674be25e8c1392d09c8409a61a310208adb7f33f03eecac6e326b4bd3137b866fed7cbd087292308e470088dc5279d484107aefac2bf5ae7ea079adbae

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mytravelexplorer.com
Port:
587
Username:
[email protected]
Password:
$g=!lt#SakbA

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1268-61-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla
behavioral1/memory/1268-62-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla
behavioral1/memory/1268-63-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla
behavioral1/memory/1268-64-0x000000000045391E-mapping.dmp	family_agenttesla
behavioral1/memory/1268-66-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla
behavioral1/memory/1268-68-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Po129834589.exe

description pid process target process

PID 1808 set thread context of 1268 1808 Po129834589.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

832 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Po129834589.exeRegSvcs.exe

pid process

1808 Po129834589.exe
1268 RegSvcs.exe
1268 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Po129834589.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1808 Po129834589.exe
Token: SeDebugPrivilege 1268 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1268 RegSvcs.exe

description	pid	process	target process
PID 1808 set thread context of 1268	1808	Po129834589.exe	RegSvcs.exe

pid	process
832	schtasks.exe

pid	process
1808	Po129834589.exe
1268	RegSvcs.exe
1268	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1808	Po129834589.exe
Token: SeDebugPrivilege	1268	RegSvcs.exe

pid	process
1268	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Po129834589.exe

description	pid	process	target process
PID 1808 wrote to memory of 832	1808	Po129834589.exe	schtasks.exe
PID 1808 wrote to memory of 832	1808	Po129834589.exe	schtasks.exe
PID 1808 wrote to memory of 832	1808	Po129834589.exe	schtasks.exe
PID 1808 wrote to memory of 832	1808	Po129834589.exe	schtasks.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe
PID 1808 wrote to memory of 1268	1808	Po129834589.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Po129834589.exe
"C:\Users\Admin\AppData\Local\Temp\Po129834589.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZHDXVlzIyQQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1363.tmp"
2⤵
- Creates scheduled task(s)
PID:832

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1363.tmp

Filesize
1KB

MD5
095df2d2b87495676bcc38b748631404

SHA1
97d995553b3d1f48958e3618627e58f1db8d9edc

SHA256
2c9c071cd50f89eb7b75bdc3134487a40fc8e8bd253d77c3e9b0dd566f8be2da

SHA512
e1dfdc16265c224d5b7502270e7ff9e3ffa79d3715f6258585ff467a68b6cc7740ebfa92516b4afd39956911afa0cca60a04c8ef88357af59d0e43a084fbefe4

Download Submit
memory/832-56-0x0000000000000000-mapping.dmp

Download
memory/1268-61-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1268-58-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1268-59-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1268-62-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1268-63-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1268-64-0x000000000045391E-mapping.dmp

Download
memory/1268-66-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1268-68-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1268-70-0x00000000739A0000-0x0000000073F4B000-memory.dmp

Filesize
5.7MB

Download
memory/1808-55-0x0000000073F50000-0x00000000744FB000-memory.dmp

Filesize
5.7MB

Download
memory/1808-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads