agenttesla | e5dad8e36007773b4adbafbaa9454e18188cc8fc19efbaa1ecf6280b9588c307

General

Target

PO.exe
Size

1.3MB
MD5

911cfe476937e7f4aad553bc0814e802
SHA1

0e8b839716a75991db3f26c5c768059f1aaff27e
SHA256

b65f542c74ced21ba853b4840f0cfad311027e518b1c3925bd530a2da424293c
SHA512

024749dbe0672625ced0f2e9b2039ba20d4b6f9ef4d5342678773b309e340f93769f081962fece7b2eed4774b0e1869801e0e773a353949c073a89b1d28da1ad

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.israelagroconsultant.com
Port:
587
Username:
[email protected]
Password:
israelagro@123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/920-64-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/920-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/920-65-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/920-66-0x00000000004473EE-mapping.dmp	family_agenttesla
behavioral1/memory/920-68-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/920-70-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\TkvuX = "C:\\Users\\Admin\\AppData\\Roaming\\TkvuX\\TkvuX.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO.exe

description pid process target process

PID 108 set thread context of 920 108 PO.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1816 schtasks.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

1336 REG.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PO.exeRegSvcs.exe

pid process

108 PO.exe
108 PO.exe
920 RegSvcs.exe
920 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 108 PO.exe
Token: SeDebugPrivilege 920 RegSvcs.exe

description	pid	process	target process
PID 108 set thread context of 920	108	PO.exe	RegSvcs.exe

pid	process
1816	schtasks.exe

pid	process
1336	REG.exe

pid	process
108	PO.exe
108	PO.exe
920	RegSvcs.exe
920	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	108	PO.exe
Token: SeDebugPrivilege	920	RegSvcs.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

PO.exeRegSvcs.exe

description	pid	process	target process
PID 108 wrote to memory of 1816	108	PO.exe	schtasks.exe
PID 108 wrote to memory of 1816	108	PO.exe	schtasks.exe
PID 108 wrote to memory of 1816	108	PO.exe	schtasks.exe
PID 108 wrote to memory of 1816	108	PO.exe	schtasks.exe
PID 108 wrote to memory of 1984	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 1984	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 1984	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 1984	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 1984	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 1984	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 1984	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 108 wrote to memory of 920	108	PO.exe	RegSvcs.exe
PID 920 wrote to memory of 1336	920	RegSvcs.exe	REG.exe
PID 920 wrote to memory of 1336	920	RegSvcs.exe	REG.exe
PID 920 wrote to memory of 1336	920	RegSvcs.exe	REG.exe
PID 920 wrote to memory of 1336	920	RegSvcs.exe	REG.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zQklBRQkb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FB7.tmp"
2⤵
- Creates scheduled task(s)
PID:1816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:920

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
3⤵
- Modifies registry key
PID:1336

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4FB7.tmp
Filesize
1KB

MD5
02c91ddd1b47cd0987ff850abb9fc761

SHA1
d6959c3bf44ea1ca8ab5c4a1cdc431bdba20a9c2

SHA256
871c921eceb8ccfed0a9def8498e0d79564e688595f4dfeb629ff8da9e47fdc6

SHA512
dfe0e3d2af6b502fa46a2c24ad87bbaddae9fe675f7dbc578d142beeee4d51e14b89dbf189784f04840286260c8f3ae71541e25113286b7cf2803caa14398041

Download Submit
memory/108-55-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/108-56-0x0000000004DE0000-0x0000000004E34000-memory.dmp

Filesize
336KB

Download
memory/108-57-0x0000000075A61000-0x0000000075A63000-memory.dmp

Filesize
8KB

Download
memory/108-54-0x0000000000FF0000-0x0000000001144000-memory.dmp

Filesize
1.3MB

Download
memory/920-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/920-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/920-64-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/920-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/920-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/920-66-0x00000000004473EE-mapping.dmp

Download
memory/920-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/920-70-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1336-72-0x0000000000000000-mapping.dmp

Download
memory/1816-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads