agenttesla | e5dad8e36007773b4adbafbaa9454e18188cc8fc19efbaa1ecf6280b9588c307

General

Target

PO.exe
Size

1.3MB
MD5

911cfe476937e7f4aad553bc0814e802
SHA1

0e8b839716a75991db3f26c5c768059f1aaff27e
SHA256

b65f542c74ced21ba853b4840f0cfad311027e518b1c3925bd530a2da424293c
SHA512

024749dbe0672625ced0f2e9b2039ba20d4b6f9ef4d5342678773b309e340f93769f081962fece7b2eed4774b0e1869801e0e773a353949c073a89b1d28da1ad

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.israelagroconsultant.com
Port:
587
Username:
[email protected]
Password:
israelagro@123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2660-138-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

PO.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation PO.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	PO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TkvuX = "C:\\Users\\Admin\\AppData\\Roaming\\TkvuX\\TkvuX.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO.exe

description pid process target process

PID 3768 set thread context of 2660 3768 PO.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

800 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

PO.exeRegSvcs.exe

pid process

3768 PO.exe
2660 RegSvcs.exe
2660 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 3768 PO.exe
Token: SeDebugPrivilege 2660 RegSvcs.exe

description	pid	process	target process
PID 3768 set thread context of 2660	3768	PO.exe	RegSvcs.exe

pid	process
800	schtasks.exe

pid	process
3768	PO.exe
2660	RegSvcs.exe
2660	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3768	PO.exe
Token: SeDebugPrivilege	2660	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

PO.exe

description	pid	process	target process
PID 3768 wrote to memory of 800	3768	PO.exe	schtasks.exe
PID 3768 wrote to memory of 800	3768	PO.exe	schtasks.exe
PID 3768 wrote to memory of 800	3768	PO.exe	schtasks.exe
PID 3768 wrote to memory of 2660	3768	PO.exe	RegSvcs.exe
PID 3768 wrote to memory of 2660	3768	PO.exe	RegSvcs.exe
PID 3768 wrote to memory of 2660	3768	PO.exe	RegSvcs.exe
PID 3768 wrote to memory of 2660	3768	PO.exe	RegSvcs.exe
PID 3768 wrote to memory of 2660	3768	PO.exe	RegSvcs.exe
PID 3768 wrote to memory of 2660	3768	PO.exe	RegSvcs.exe
PID 3768 wrote to memory of 2660	3768	PO.exe	RegSvcs.exe
PID 3768 wrote to memory of 2660	3768	PO.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zQklBRQkb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp94ED.tmp"
2⤵
- Creates scheduled task(s)
PID:800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp94ED.tmp
Filesize
1KB

MD5
40ec3a4752eae2c5d998ff27898d8047

SHA1
433f93b6b8bb649f1a9516dfbc8348e6d75fce69

SHA256
b811c6360e7ca6fec5c060a9d21c8d5dcff0e7da304be18421395242c817a27c

SHA512
4bea0377e22e7387dadd82f06966ee4cbf092aa70f84e7b87f404d5f45d10cc3694372e407bdfc4e088899fc664c31f42466003a5e37f18167eb46e71f331667

Download Submit
memory/800-135-0x0000000000000000-mapping.dmp

Download
memory/2660-137-0x0000000000000000-mapping.dmp

Download
memory/2660-138-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2660-139-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/2660-140-0x00000000068B0000-0x0000000006900000-memory.dmp

Filesize
320KB

Download
memory/3768-130-0x00000000002D0000-0x0000000000424000-memory.dmp

Filesize
1.3MB

Download
memory/3768-131-0x00000000053B0000-0x0000000005954000-memory.dmp

Filesize
5.6MB

Download
memory/3768-132-0x0000000004E00000-0x0000000004E92000-memory.dmp

Filesize
584KB

Download
memory/3768-133-0x0000000005200000-0x0000000005212000-memory.dmp

Filesize
72KB

Download
memory/3768-134-0x00000000052C0000-0x000000000535C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads