agenttesla | d47679272e0703a72acb1256f5ec4fe1a937867a934757cd18d739d41c04e3dc

General

Target

Herewith all the scanned copies as required.exe
Size

487KB
MD5

7ae34697625f5ce346cd7981faae04ee
SHA1

a91f9ef9f38be360fde0afd5d7993b863d3eeafc
SHA256

70e42d439e0edb6d2a475dc3e51380469ed3c2e2d3e1a063705e60d0db2cdd54
SHA512

413b92815d9aaa074b9247eb4a5f77982d5c15a500f73c579161210f40fc70fea911107d773c93c79df7d1274c192a73ee062df71c3837c653e5e773a065ff80

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.hraspirations.com/
Port:
21
Username:
[email protected]
Password:
computer@147

Protocol: ftp
Host:
ftp://ftp.hraspirations.com/
Port:
21
Username:
[email protected]
Password:
computer@147

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1440-64-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1440-65-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1440-66-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1440-67-0x000000000044734E-mapping.dmp	family_agenttesla
behavioral1/memory/1440-69-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1440-71-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Herewith all the scanned copies as required.exe

description pid process target process

PID 884 set thread context of 1440 884 Herewith all the scanned copies as required.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2016 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Herewith all the scanned copies as required.exeRegSvcs.exe

pid process

884 Herewith all the scanned copies as required.exe
884 Herewith all the scanned copies as required.exe
1440 RegSvcs.exe
1440 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Herewith all the scanned copies as required.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 884 Herewith all the scanned copies as required.exe
Token: SeDebugPrivilege 1440 RegSvcs.exe

description	pid	process	target process
PID 884 set thread context of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe

pid	process
2016	schtasks.exe

pid	process
884	Herewith all the scanned copies as required.exe
884	Herewith all the scanned copies as required.exe
1440	RegSvcs.exe
1440	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	884	Herewith all the scanned copies as required.exe
Token: SeDebugPrivilege	1440	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Herewith all the scanned copies as required.exe

description	pid	process	target process
PID 884 wrote to memory of 2016	884	Herewith all the scanned copies as required.exe	schtasks.exe
PID 884 wrote to memory of 2016	884	Herewith all the scanned copies as required.exe	schtasks.exe
PID 884 wrote to memory of 2016	884	Herewith all the scanned copies as required.exe	schtasks.exe
PID 884 wrote to memory of 2016	884	Herewith all the scanned copies as required.exe	schtasks.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe
PID 884 wrote to memory of 1440	884	Herewith all the scanned copies as required.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Herewith all the scanned copies as required.exe
"C:\Users\Admin\AppData\Local\Temp\Herewith all the scanned copies as required.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF892.tmp"
2⤵
- Creates scheduled task(s)
PID:2016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1440

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF892.tmp
Filesize
1KB

MD5
ab15c7fe3dc23f51a8ed4545eb54a9cb

SHA1
206a5e711a5b8819deae10c568fa760a23d9308c

SHA256
2889f7b15e75b474bfa37c720f216861f138e8e39e1d2f807ce751a21086674b

SHA512
29b8f09dfa625fad63d6cae0fd9d9f9ea19a4b5a001138c5afb644c0d37f1cc2e7bf51a4242af433568b22b19613b1570a234474663cc659dd4ad54c7407a114

Download Submit
memory/884-57-0x0000000004780000-0x00000000047EA000-memory.dmp

Filesize
424KB

Download
memory/884-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/884-54-0x0000000000D70000-0x0000000000DF0000-memory.dmp

Filesize
512KB

Download
memory/884-58-0x0000000000530000-0x0000000000586000-memory.dmp

Filesize
344KB

Download
memory/884-56-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/1440-66-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1440-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1440-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1440-64-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1440-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1440-67-0x000000000044734E-mapping.dmp

Download
memory/1440-69-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1440-71-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2016-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads