agenttesla | 4825fd78e406e9bcb21ff45b65bc0b4bde7826243ead732bbbe03d032e4e7f05

General

Target

CALL KENDARI FOR LOADING.exe
Size

578KB
MD5

040ffb26c9ab0884a0aa2af46a92a19e
SHA1

c435f24b858eb46e9b812042f5c40c81a4228d7d
SHA256

789745b0db567cfc2ecf3c1230dac5b4063f091a48eba1137f8869edb2cfc7b6
SHA512

c3f8b6aea26cb75409e91145d87ea1d164f954771f8cba601253a7de0f98f056fefeb2f8c8342b89ab7be53bab7d7d844b7fe56faad0297096f53a5e2b84270e

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
vicanto1994

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2152-137-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CALL KENDARI FOR LOADING.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	CALL KENDARI FOR LOADING.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

CALL KENDARI FOR LOADING.exe

description pid process target process

PID 2420 set thread context of 2152 2420 CALL KENDARI FOR LOADING.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

864 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

CALL KENDARI FOR LOADING.exeMSBuild.exe

pid process

2420 CALL KENDARI FOR LOADING.exe
2152 MSBuild.exe
2152 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CALL KENDARI FOR LOADING.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 2420 CALL KENDARI FOR LOADING.exe
Token: SeDebugPrivilege 2152 MSBuild.exe

description	pid	process	target process
PID 2420 set thread context of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe

pid	process
864	schtasks.exe

pid	process
2420	CALL KENDARI FOR LOADING.exe
2152	MSBuild.exe
2152	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2420	CALL KENDARI FOR LOADING.exe
Token: SeDebugPrivilege	2152	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

CALL KENDARI FOR LOADING.exe

description	pid	process	target process
PID 2420 wrote to memory of 864	2420	CALL KENDARI FOR LOADING.exe	schtasks.exe
PID 2420 wrote to memory of 864	2420	CALL KENDARI FOR LOADING.exe	schtasks.exe
PID 2420 wrote to memory of 864	2420	CALL KENDARI FOR LOADING.exe	schtasks.exe
PID 2420 wrote to memory of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 2420 wrote to memory of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 2420 wrote to memory of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 2420 wrote to memory of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 2420 wrote to memory of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 2420 wrote to memory of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 2420 wrote to memory of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 2420 wrote to memory of 2152	2420	CALL KENDARI FOR LOADING.exe	MSBuild.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\CALL KENDARI FOR LOADING.exe
"C:\Users\Admin\AppData\Local\Temp\CALL KENDARI FOR LOADING.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zRLgrOm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3691.tmp"
2⤵
- Creates scheduled task(s)
PID:864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3691.tmp
Filesize
1KB

MD5
021b0e1d50fbac4f0ed8fc01ec2a9202

SHA1
7d82d773b71a1922d76fc991dd62f79b89eac290

SHA256
0b506960c6b1699c51794b56239b7c03555039abd41acc87efa2d0fba7ed7dba

SHA512
4fd5003906595918bdd5bbf44bc1d0af90b2decb6ecd70685676a2725d03cc4f8314b1a12d57b6faa678e551e89984d0a22503cb678f9959c79b6c511fd89bdc

Download Submit
memory/864-134-0x0000000000000000-mapping.dmp

Download
memory/2152-136-0x0000000000000000-mapping.dmp

Download
memory/2152-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2152-138-0x0000000006200000-0x0000000006266000-memory.dmp

Filesize
408KB

Download
memory/2152-139-0x0000000006930000-0x0000000006980000-memory.dmp

Filesize
320KB

Download
memory/2152-140-0x0000000006A20000-0x0000000006A2A000-memory.dmp

Filesize
40KB

Download
memory/2420-130-0x00000000007A0000-0x0000000000836000-memory.dmp

Filesize
600KB

Download
memory/2420-131-0x0000000005210000-0x00000000052AC000-memory.dmp

Filesize
624KB

Download
memory/2420-132-0x0000000005350000-0x00000000053E2000-memory.dmp

Filesize
584KB

Download
memory/2420-133-0x0000000005FC0000-0x0000000006564000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads