agenttesla | 006c44f3be8c5386db93ce002df488496970d49e2a02460a412891a32ca8bc35

General

Target

Outstanding_2019-20.exe
Size

430KB
MD5

d05aa23160135954f7c299417c180a3d
SHA1

092b8174bdadbee284b574cf9fd1c9c50e195c12
SHA256

7ad0932d78113412ba4404ed897c0981f8582886940866f7908c07d99ee077a9
SHA512

322679ef529e5f7436efd8174c5852010eae7fe42e09ac5b39a51d7c407ba6114cf84fba9890ae275f3220a8c8a48b2f998805b86a8c731e03f3925dbc3cbbf5

Score

10^/10

agenttesla collection evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pro-powersourcing.com
Port:
587
Username:
[email protected]
Password:
china1977

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4444-137-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Disables Task Manager via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Outstanding_2019-20.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Outstanding_2019-20.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Outstanding_2019-20.exe

description pid process target process

PID 4236 set thread context of 4444 4236 Outstanding_2019-20.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1668 4444 WerFault.exe RegSvcs.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3476 schtasks.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

4568 REG.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Outstanding_2019-20.exeRegSvcs.exe

pid process

4236 Outstanding_2019-20.exe
4236 Outstanding_2019-20.exe
4236 Outstanding_2019-20.exe
4236 Outstanding_2019-20.exe
4444 RegSvcs.exe
4444 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Outstanding_2019-20.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 4236 Outstanding_2019-20.exe
Token: SeDebugPrivilege 4444 RegSvcs.exe

description	pid	process	target process
PID 4236 set thread context of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe

pid	pid_target	process	target process
1668	4444	WerFault.exe	RegSvcs.exe

pid	process
3476	schtasks.exe

pid	process
4568	REG.exe

pid	process
4236	Outstanding_2019-20.exe
4236	Outstanding_2019-20.exe
4236	Outstanding_2019-20.exe
4236	Outstanding_2019-20.exe
4444	RegSvcs.exe
4444	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4236	Outstanding_2019-20.exe
Token: SeDebugPrivilege	4444	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Outstanding_2019-20.exeRegSvcs.exe

description	pid	process	target process
PID 4236 wrote to memory of 3476	4236	Outstanding_2019-20.exe	schtasks.exe
PID 4236 wrote to memory of 3476	4236	Outstanding_2019-20.exe	schtasks.exe
PID 4236 wrote to memory of 3476	4236	Outstanding_2019-20.exe	schtasks.exe
PID 4236 wrote to memory of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe
PID 4236 wrote to memory of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe
PID 4236 wrote to memory of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe
PID 4236 wrote to memory of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe
PID 4236 wrote to memory of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe
PID 4236 wrote to memory of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe
PID 4236 wrote to memory of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe
PID 4236 wrote to memory of 4444	4236	Outstanding_2019-20.exe	RegSvcs.exe
PID 4444 wrote to memory of 4568	4444	RegSvcs.exe	REG.exe
PID 4444 wrote to memory of 4568	4444	RegSvcs.exe	REG.exe
PID 4444 wrote to memory of 4568	4444	RegSvcs.exe	REG.exe
PID 4444 wrote to memory of 5008	4444	RegSvcs.exe	netsh.exe
PID 4444 wrote to memory of 5008	4444	RegSvcs.exe	netsh.exe
PID 4444 wrote to memory of 5008	4444	RegSvcs.exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Outstanding_2019-20.exe
"C:\Users\Admin\AppData\Local\Temp\Outstanding_2019-20.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ARTqjgRpnyI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6E79.tmp"
2⤵
- Creates scheduled task(s)
PID:3476

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4444

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:4568

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1596
3⤵
- Program crash
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4444 -ip 4444
1⤵
PID:2384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6E79.tmp
Filesize
1KB

MD5
8aa185c57a042e5ae1e49123308a5aea

SHA1
9935a63d17ff744967beabfabba4295bb17bac05

SHA256
52a17ce6e1ee2f5971c599ac66af28a0cf70f442ee409a4710429eafefdb6a55

SHA512
8e3d85420eb360f24b2433b6e75209f89f38df158491b35f8afa852aefe728adc6521dc48cae9a50e13b9d66efb344af853610d150a27535b5ba211924c6f0be

Download Submit
memory/3476-134-0x0000000000000000-mapping.dmp

Download
memory/4236-130-0x0000000000020000-0x0000000000092000-memory.dmp

Filesize
456KB

Download
memory/4236-131-0x0000000004CB0000-0x0000000004D4C000-memory.dmp

Filesize
624KB

Download
memory/4236-132-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Filesize
584KB

Download
memory/4236-133-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/4444-136-0x0000000000000000-mapping.dmp

Download
memory/4444-137-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4444-138-0x0000000006710000-0x0000000006776000-memory.dmp

Filesize
408KB

Download
memory/4444-141-0x0000000006DB0000-0x0000000006E00000-memory.dmp

Filesize
320KB

Download
memory/4568-139-0x0000000000000000-mapping.dmp

Download
memory/5008-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads