agenttesla | c36a8ebca4a3b885c2946057ed5ce645242ed43b969b9a56f2ab2d224914b8d9

General

Target

Bank Details.pdf.exe
Size

470KB
MD5

f13e09c25b9c7c10247bb018181a8814
SHA1

5bfffdee2bedf34c51efd4d1caf546f5d2f0302d
SHA256

2ae952b2cc6f04f55a42c82386e16ddece41b1f8f6cff192cc18eb2b037d89b4
SHA512

0c44eb7d8a5d0d07d0a180d548fbe3c8e13b4077d1b99ae2ab9cf058a4040eb369cf41d578d3366f7502ce5b5cfb28f2c47287f8aa8a61f470fc6b7022aa6466

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.hotel71.com.bd
Port:
587
Username:
[email protected]
Password:
9+^va&phP1v9

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4652-136-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Disables Task Manager via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Bank Details.pdf.exe

description pid process target process

PID 1100 set thread context of 4652 1100 Bank Details.pdf.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 4652 WerFault.exe RegSvcs.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

2284 REG.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

4652 RegSvcs.exe
4652 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 4652 RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

description	pid	process	target process
PID 1100 set thread context of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe

pid	pid_target	process	target process
1916	4652	WerFault.exe	RegSvcs.exe

pid	process
2284	REG.exe

pid	process
4652	RegSvcs.exe
4652	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4652	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Bank Details.pdf.exeRegSvcs.exe

description	pid	process	target process
PID 1100 wrote to memory of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe
PID 1100 wrote to memory of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe
PID 1100 wrote to memory of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe
PID 1100 wrote to memory of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe
PID 1100 wrote to memory of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe
PID 1100 wrote to memory of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe
PID 1100 wrote to memory of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe
PID 1100 wrote to memory of 4652	1100	Bank Details.pdf.exe	RegSvcs.exe
PID 4652 wrote to memory of 2284	4652	RegSvcs.exe	REG.exe
PID 4652 wrote to memory of 2284	4652	RegSvcs.exe	REG.exe
PID 4652 wrote to memory of 2284	4652	RegSvcs.exe	REG.exe
PID 4652 wrote to memory of 4596	4652	RegSvcs.exe	netsh.exe
PID 4652 wrote to memory of 4596	4652	RegSvcs.exe	netsh.exe
PID 4652 wrote to memory of 4596	4652	RegSvcs.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Bank Details.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Details.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:2284

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1564
3⤵
- Program crash
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4652 -ip 4652
1⤵
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-130-0x0000000000330000-0x00000000003AC000-memory.dmp

Filesize
496KB

Download
memory/1100-131-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/1100-132-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Filesize
584KB

Download
memory/1100-133-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/1100-134-0x00000000087E0000-0x000000000887C000-memory.dmp

Filesize
624KB

Download
memory/2284-138-0x0000000000000000-mapping.dmp

Download
memory/4596-140-0x0000000000000000-mapping.dmp

Download
memory/4652-135-0x0000000000000000-mapping.dmp

Download
memory/4652-136-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4652-137-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/4652-139-0x0000000006B50000-0x0000000006BA0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing