agenttesla | 12a9296bbae006899ed14d94a52cdd92853798ae302b83ba57375642e53f2929

General

Target

INVOICE.exe
Size

594KB
MD5

cdf5b175db3a7b60a0734daf15364717
SHA1

c56332d8c17c6aa873dbf177c44472409628ae05
SHA256

1df1597314ab01b00a84f5a025cb5112828d20fbc59dd3098fcb45fb88534661
SHA512

0df64f13bf872ffcf5693076c05301fb8786b3c100232f76284594c8990556c189f864212a13075094216acdf6b6352c345d2495953a5fa528d151111a1edb01

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.grandtours.gr
Port:
587
Username:
[email protected]
Password:
!Bitter-bullet-chuck-major!

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/952-63-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/952-64-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/952-65-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/952-66-0x00000000004610AE-mapping.dmp	family_agenttesla
behavioral1/memory/952-68-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/952-70-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

INVOICE.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\xxspw = "C:\\Users\\Admin\\AppData\\Roaming\\xxspw\\xxspw.exe"	INVOICE.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

INVOICE.exe

description pid process target process

PID 1896 set thread context of 952 1896 INVOICE.exe INVOICE.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1292 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

INVOICE.exeINVOICE.exe

pid process

1896 INVOICE.exe
1896 INVOICE.exe
952 INVOICE.exe
952 INVOICE.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INVOICE.exeINVOICE.exe

description pid process

Token: SeDebugPrivilege 1896 INVOICE.exe
Token: SeDebugPrivilege 952 INVOICE.exe

description	pid	process	target process
PID 1896 set thread context of 952	1896	INVOICE.exe	INVOICE.exe

pid	process
1292	schtasks.exe

pid	process
1896	INVOICE.exe
1896	INVOICE.exe
952	INVOICE.exe
952	INVOICE.exe

description	pid	process
Token: SeDebugPrivilege	1896	INVOICE.exe
Token: SeDebugPrivilege	952	INVOICE.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

INVOICE.exe

description	pid	process	target process
PID 1896 wrote to memory of 1292	1896	INVOICE.exe	schtasks.exe
PID 1896 wrote to memory of 1292	1896	INVOICE.exe	schtasks.exe
PID 1896 wrote to memory of 1292	1896	INVOICE.exe	schtasks.exe
PID 1896 wrote to memory of 1292	1896	INVOICE.exe	schtasks.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe
PID 1896 wrote to memory of 952	1896	INVOICE.exe	INVOICE.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AtVXDrAK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C37.tmp"
2⤵
- Creates scheduled task(s)
PID:1292

C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
"{path}"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3C37.tmp

Filesize
1KB

MD5
22ed861c53338b6f7adb2da1146527de

SHA1
67d5136a922a39538946740982422384825462e7

SHA256
de09af26130ff1e5f540e97b20b22e918b3ffdad61fddf48951c286ea21c7a73

SHA512
6988d0c7927fb6a640485ceb37f331f807bc303dbbefc33111b1b3aafb4cc6f76802082de11456549f59b576421b88b20aee3fd3ca623ae7255579470382e2c6

Download Submit
memory/952-64-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/952-66-0x00000000004610AE-mapping.dmp

Download
memory/952-71-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/952-70-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/952-68-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/952-60-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/952-61-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/952-63-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/952-65-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1292-58-0x0000000000000000-mapping.dmp

Download
memory/1896-54-0x00000000012C0000-0x000000000135A000-memory.dmp

Filesize
616KB

Download
memory/1896-56-0x00000000010A0000-0x0000000001126000-memory.dmp

Filesize
536KB

Download
memory/1896-55-0x00000000002F0000-0x00000000002FA000-memory.dmp

Filesize
40KB

Download
memory/1896-57-0x0000000004B80000-0x0000000004C04000-memory.dmp

Filesize
528KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads