agenttesla | 782083fbf59bde49ea9e6fe9b81bd4e2c0caf67d032b6c130d74f4826ba5ed02

Analysis

max time kernel
91s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ_502480987.exe
Size

456KB
MD5

824a7153c1a14e7ddf069f46157a1d9d
SHA1

77116aba7ff9d7ef6a897a904ba8ce03816766e0
SHA256

bacaaa40e0f3b6cba3fc498dfbd6f2d198a767453cd8513acdbafa9fefaeed2a
SHA512

1704738f458c31490359a25c8dd5c25d5201b9c448d4e6ddade8b00871e8348c56095a5d97efbe79288987c11902741ed4e0e3fd3e52172f9e844023f594e1b9

Score

10^/10

agenttesla collection evasion keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
gatefee22

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
gatefee22

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3048-156-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RFQ_502480987.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RFQ_502480987.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RFQ_502480987.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RFQ_502480987.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	RFQ_502480987.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

RFQ_502480987.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	RFQ_502480987.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	RFQ_502480987.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RFQ_502480987.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ_502480987.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ_502480987.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ_502480987.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

RFQ_502480987.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RFQ_502480987.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	RFQ_502480987.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ_502480987.exe

description pid process target process

PID 2836 set thread context of 3048 2836 RFQ_502480987.exe RFQ_502480987.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2208 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exeRFQ_502480987.exeRFQ_502480987.exe

pid process

4380 powershell.exe
4380 powershell.exe
2836 RFQ_502480987.exe
2836 RFQ_502480987.exe
3048 RFQ_502480987.exe
3048 RFQ_502480987.exe

description	pid	process	target process
PID 2836 set thread context of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe

pid	process
2208	schtasks.exe

pid	process
4380	powershell.exe
4380	powershell.exe
2836	RFQ_502480987.exe
2836	RFQ_502480987.exe
3048	RFQ_502480987.exe
3048	RFQ_502480987.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeRFQ_502480987.exeRFQ_502480987.exe

description	pid	process
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	2836	RFQ_502480987.exe
Token: SeDebugPrivilege	3048	RFQ_502480987.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RFQ_502480987.exe

pid process

3048 RFQ_502480987.exe

pid	process
3048	RFQ_502480987.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

RFQ_502480987.exe

description	pid	process	target process
PID 2836 wrote to memory of 4380	2836	RFQ_502480987.exe	powershell.exe
PID 2836 wrote to memory of 4380	2836	RFQ_502480987.exe	powershell.exe
PID 2836 wrote to memory of 4380	2836	RFQ_502480987.exe	powershell.exe
PID 2836 wrote to memory of 2208	2836	RFQ_502480987.exe	schtasks.exe
PID 2836 wrote to memory of 2208	2836	RFQ_502480987.exe	schtasks.exe
PID 2836 wrote to memory of 2208	2836	RFQ_502480987.exe	schtasks.exe
PID 2836 wrote to memory of 2004	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 2004	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 2004	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe
PID 2836 wrote to memory of 3048	2836	RFQ_502480987.exe	RFQ_502480987.exe

outlook_office_path 1 IoCs

Processes:

RFQ_502480987.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ_502480987.exe

outlook_win_path 1 IoCs

Processes:

RFQ_502480987.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ_502480987.exe

C:\Users\Admin\AppData\Local\Temp\RFQ_502480987.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_502480987.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PLwwYlHf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE17B.tmp"
2⤵
- Creates scheduled task(s)
PID:2208

C:\Users\Admin\AppData\Local\Temp\RFQ_502480987.exe
"{path}"
2⤵
PID:2004

C:\Users\Admin\AppData\Local\Temp\RFQ_502480987.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ_502480987.exe.log
Filesize
1KB

MD5
e08f822522c617a40840c62e4b0fb45e

SHA1
ae516dca4da5234be6676d3f234c19ec55725be7

SHA256
bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7

SHA512
894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE17B.tmp
Filesize
1KB

MD5
d1f9e91784b801f4f3f1e4477dc4fca1

SHA1
8a8f37e49558c62b14871ff7f24af4848fa5104f

SHA256
eca1fff3215704d0f0d3a25486fa747d2d279d501bfa14d82cd6a7c56fc65945

SHA512
548eab556c0c4fb883c5fd7f6381c99632ded93a3d1adaaec9fc411e3e5df6d166f9b625fee687231e7673cf6d9bb954c37b55dda166c7f2e6c775157cff86c1

Download Submit
memory/2004-154-0x0000000000000000-mapping.dmp

Download
memory/2208-152-0x0000000000000000-mapping.dmp

Download
memory/2836-130-0x0000000000B30000-0x0000000000BA8000-memory.dmp

Filesize
480KB

Download
memory/2836-131-0x0000000005B20000-0x00000000060C4000-memory.dmp

Filesize
5.6MB

Download
memory/2836-132-0x0000000005570000-0x0000000005602000-memory.dmp

Filesize
584KB

Download
memory/2836-133-0x0000000005700000-0x000000000570A000-memory.dmp

Filesize
40KB

Download
memory/2836-134-0x0000000007A40000-0x0000000007ADC000-memory.dmp

Filesize
624KB

Download
memory/3048-158-0x00000000067F0000-0x0000000006840000-memory.dmp

Filesize
320KB

Download
memory/3048-156-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3048-155-0x0000000000000000-mapping.dmp

Download
memory/4380-144-0x00000000069B0000-0x00000000069CE000-memory.dmp

Filesize
120KB

Download
memory/4380-151-0x0000000007A40000-0x0000000007A48000-memory.dmp

Filesize
32KB

Download
memory/4380-142-0x00000000069E0000-0x0000000006A12000-memory.dmp

Filesize
200KB

Download
memory/4380-145-0x0000000007D50000-0x00000000083CA000-memory.dmp

Filesize
6.5MB

Download
memory/4380-146-0x0000000007710000-0x000000000772A000-memory.dmp

Filesize
104KB

Download
memory/4380-147-0x0000000007780000-0x000000000778A000-memory.dmp

Filesize
40KB

Download
memory/4380-148-0x0000000007990000-0x0000000007A26000-memory.dmp

Filesize
600KB

Download
memory/4380-149-0x0000000007950000-0x000000000795E000-memory.dmp

Filesize
56KB

Download
memory/4380-150-0x0000000007A50000-0x0000000007A6A000-memory.dmp

Filesize
104KB

Download
memory/4380-143-0x000000006FE40000-0x000000006FE8C000-memory.dmp

Filesize
304KB

Download
memory/4380-141-0x0000000005190000-0x00000000051AE000-memory.dmp

Filesize
120KB

Download
memory/4380-140-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/4380-139-0x0000000005D20000-0x0000000005D86000-memory.dmp

Filesize
408KB

Download
memory/4380-138-0x0000000005540000-0x0000000005562000-memory.dmp

Filesize
136KB

Download
memory/4380-137-0x00000000056F0000-0x0000000005D18000-memory.dmp

Filesize
6.2MB

Download
memory/4380-136-0x0000000002B00000-0x0000000002B36000-memory.dmp

Filesize
216KB

Download
memory/4380-135-0x0000000000000000-mapping.dmp

Download