agenttesla | abcba065d8902f508e86614c9c0d16289dec443f64fb412bd040641473488ed8

General

Target

Bank Report.pdf.exe
Size

622KB
MD5

609427cc5598d5183654e09fc7312067
SHA1

da0d6d1050134e74e291bfd4f95069af2d661e2b
SHA256

dbf694fcd9a32d44e248d929d8e76c8c2e64645f591f604be81f4fe46fde7945
SHA512

5a99a050270dd95ef835447a39bb2f604de9bc8861f8b25df621e8be32dbdc4c78ba4dbfa980bb452a353db64da562ebe5f18a4b2728922ede72536b25317be3

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.coffiices.com
Port:
587
Username:
[email protected]
Password:
E5%lCvZ{l[6FG

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1956-65-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1956-64-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1956-71-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1956-69-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1956-67-0x000000000044761E-mapping.dmp	family_agenttesla
behavioral1/memory/1956-66-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

Bank Report.pdf.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts Bank Report.pdf.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Bank Report.pdf.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Bank Report.pdf.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bank Report.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bank Report.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bank Report.pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Bank Report.pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\goICPG = "C:\\Users\\Admin\\AppData\\Roaming\\goICPG\\goICPG.exe"	Bank Report.pdf.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Bank Report.pdf.exe

description pid process target process

PID 480 set thread context of 1956 480 Bank Report.pdf.exe Bank Report.pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1252 schtasks.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

1884 REG.exe

description	pid	process	target process
PID 480 set thread context of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe

pid	process
1252	schtasks.exe

pid	process
1884	REG.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Bank Report.pdf.exeBank Report.pdf.exe

pid	process
480	Bank Report.pdf.exe
480	Bank Report.pdf.exe
480	Bank Report.pdf.exe
480	Bank Report.pdf.exe
480	Bank Report.pdf.exe
1956	Bank Report.pdf.exe
1956	Bank Report.pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Bank Report.pdf.exeBank Report.pdf.exe

description pid process

Token: SeDebugPrivilege 480 Bank Report.pdf.exe
Token: SeDebugPrivilege 1956 Bank Report.pdf.exe

description	pid	process
Token: SeDebugPrivilege	480	Bank Report.pdf.exe
Token: SeDebugPrivilege	1956	Bank Report.pdf.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

Bank Report.pdf.exeBank Report.pdf.exe

description	pid	process	target process
PID 480 wrote to memory of 1252	480	Bank Report.pdf.exe	schtasks.exe
PID 480 wrote to memory of 1252	480	Bank Report.pdf.exe	schtasks.exe
PID 480 wrote to memory of 1252	480	Bank Report.pdf.exe	schtasks.exe
PID 480 wrote to memory of 1252	480	Bank Report.pdf.exe	schtasks.exe
PID 480 wrote to memory of 1996	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1996	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1996	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1996	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1812	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1812	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1812	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1812	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1464	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1464	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1464	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1464	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 480 wrote to memory of 1956	480	Bank Report.pdf.exe	Bank Report.pdf.exe
PID 1956 wrote to memory of 1884	1956	Bank Report.pdf.exe	REG.exe
PID 1956 wrote to memory of 1884	1956	Bank Report.pdf.exe	REG.exe
PID 1956 wrote to memory of 1884	1956	Bank Report.pdf.exe	REG.exe
PID 1956 wrote to memory of 1884	1956	Bank Report.pdf.exe	REG.exe

outlook_office_path 1 IoCs

Processes:

Bank Report.pdf.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bank Report.pdf.exe

outlook_win_path 1 IoCs

Processes:

Bank Report.pdf.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bank Report.pdf.exe

C:\Users\Admin\AppData\Local\Temp\Bank Report.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Report.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:480

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gQkRtAzeAt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF864.tmp"
2⤵
- Creates scheduled task(s)
PID:1252

C:\Users\Admin\AppData\Local\Temp\Bank Report.pdf.exe
"{path}"
2⤵
PID:1996

C:\Users\Admin\AppData\Local\Temp\Bank Report.pdf.exe
"{path}"
2⤵
PID:1812

C:\Users\Admin\AppData\Local\Temp\Bank Report.pdf.exe
"{path}"
2⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\Bank Report.pdf.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1956

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
3⤵
- Modifies registry key
PID:1884

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF864.tmp
Filesize
1KB

MD5
8ec3235b70c37cf1f59a337b0f3ef550

SHA1
d6e764b4488be9a2d4e4744cc45bbe4c88efe064

SHA256
61ac70f22fbf97e8ecabcc89abc3165aad1a35a379b74d52db6af13714cc1c28

SHA512
6d561b979a57a93cee4d7b58e9161564a7ab0d282adb96544a04823bbb9a3168adc92f462136aa04156f303176d204d26008c63711bd859bdabeb67279c86b2d

Download Submit
memory/480-54-0x0000000000020000-0x00000000000C2000-memory.dmp

Filesize
648KB

Download
memory/480-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/480-56-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/480-57-0x0000000000470000-0x00000000004F4000-memory.dmp

Filesize
528KB

Download
memory/480-58-0x0000000007330000-0x000000000739E000-memory.dmp

Filesize
440KB

Download
memory/1252-59-0x0000000000000000-mapping.dmp

Download
memory/1884-73-0x0000000000000000-mapping.dmp

Download
memory/1956-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1956-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1956-64-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1956-71-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1956-69-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1956-67-0x000000000044761E-mapping.dmp

Download
memory/1956-66-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1956-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads