agenttesla | 6e89462a3608149699b7bc38e573fce07a7e62759d3d42f578e3cebbf754bb9c

General

Target

QUOTATIO.exe
Size

407KB
MD5

086d3778e1a2fbd66b2306a1410ba159
SHA1

79e0b0ad3ec89b316ca19e49e385dffd804dcdce
SHA256

95a2794993515cebc252e9c2862009a653f5c8930b78127fa7ba34b59493291c
SHA512

31b980f9b47321531189734a644cddc3d129040b00a2c52c1855287decc55d0f77b955a7dd5db20b2fb6deef5ddaab97f4762df19f1b2573ac4fd56caa292955

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
chika12345@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/976-63-0x0000000000400000-0x000000000044A000-memory.dmp	family_agenttesla
behavioral1/memory/976-64-0x0000000000400000-0x000000000044A000-memory.dmp	family_agenttesla
behavioral1/memory/976-65-0x0000000000400000-0x000000000044A000-memory.dmp	family_agenttesla
behavioral1/memory/976-66-0x0000000000445F6E-mapping.dmp	family_agenttesla
behavioral1/memory/976-68-0x0000000000400000-0x000000000044A000-memory.dmp	family_agenttesla
behavioral1/memory/976-70-0x0000000000400000-0x000000000044A000-memory.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTATIO.exe

description pid process target process

PID 1500 set thread context of 976 1500 QUOTATIO.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1352 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

976 RegSvcs.exe
976 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 976 RegSvcs.exe

description	pid	process	target process
PID 1500 set thread context of 976	1500	QUOTATIO.exe	RegSvcs.exe

pid	process
1352	schtasks.exe

pid	process
976	RegSvcs.exe
976	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	976	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

QUOTATIO.exe

description	pid	process	target process
PID 1500 wrote to memory of 1352	1500	QUOTATIO.exe	schtasks.exe
PID 1500 wrote to memory of 1352	1500	QUOTATIO.exe	schtasks.exe
PID 1500 wrote to memory of 1352	1500	QUOTATIO.exe	schtasks.exe
PID 1500 wrote to memory of 1352	1500	QUOTATIO.exe	schtasks.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe
PID 1500 wrote to memory of 976	1500	QUOTATIO.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HKiFBdxSAREQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC79.tmp"
2⤵
- Creates scheduled task(s)
PID:1352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFC79.tmp

Filesize
1KB

MD5
59a9ed87cbae2df02b93e0b243b96cdf

SHA1
99c858874ce652128a4c6343a73d1e7625a26267

SHA256
e7c55a1c0941ba7cc1b25675e88879df6f4132aaa907fc06b6aec552cc6cea82

SHA512
ad8e047dad40dc4f40b1aa43d08e2bb072a4bf7b0d89dd5236b2aa841190b479792fbfcc9c7c7bf39ad981331243fc647fddb30b84ffa48af0acb432328aa9ef

Download Submit
memory/976-64-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/976-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/976-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/976-63-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/976-65-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/976-66-0x0000000000445F6E-mapping.dmp

Download
memory/976-68-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/976-70-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1352-58-0x0000000000000000-mapping.dmp

Download
memory/1500-56-0x00000000045F0000-0x0000000004642000-memory.dmp

Filesize
328KB

Download
memory/1500-57-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download
memory/1500-55-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/1500-54-0x0000000001180000-0x00000000011EC000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads