agenttesla | 45179fd28fc956620d273d4189756307a6ca686355e5106fff4480c602578b7d

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL_AWB #1008936572891_pdf.exe
Size

1.5MB
MD5

183595e45c54758cd9adaeb3afe302e9
SHA1

aa4e83e6080009a5aa03e29f74ed6a5f0a0b3f3a
SHA256

b46bd25fca309781558509bdb4f408b085d83c74e71adc5de4eeb349bc8c4c7a
SHA512

01b868664c430433720a10929aef909355a5487b6cbc2f21d27ac143a84bf440235585934ad50bc82e0ff1c7269fcc65fb89944a7d5b0c2e0719352b1c89211c

Score

10^/10

agenttesla matiex collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

matiex

https://api.telegram.org/bot1328029504:AAGKFzQ1tJdWqJzQg7lW0DK-JgG0_8hFEEk/sendMessage?chat_id=1072388187

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1628-130-0x00000000004E0000-0x0000000000664000-memory.dmp	family_matiex
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dup.exe	family_matiex
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dup.exe	family_matiex
behavioral2/memory/4928-136-0x0000000000B30000-0x0000000000BA4000-memory.dmp	family_matiex

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1628-130-0x00000000004E0000-0x0000000000664000-memory.dmp	family_agenttesla
behavioral2/memory/4012-140-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

Processes:

dup.exeRegAsm.exe

pid process

4928 dup.exe
4012 RegAsm.exe

pid	process
4928	dup.exe
4012	RegAsm.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DHL_AWB #1008936572891_pdf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	DHL_AWB #1008936572891_pdf.exe

Drops startup file 1 IoCs

Processes:

DHL_AWB #1008936572891_pdf.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dup.exe DHL_AWB #1008936572891_pdf.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dup.exe	DHL_AWB #1008936572891_pdf.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

dup.exeRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WEqfDb = "C:\\Users\\Admin\\AppData\\Roaming\\WEqfDb\\WEqfDb.exe"	RegAsm.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 checkip.dyndns.org
17 freegeoip.app
18 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL_AWB #1008936572891_pdf.exe

description pid process target process

PID 1628 set thread context of 4012 1628 DHL_AWB #1008936572891_pdf.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

208 4928 WerFault.exe dup.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

DHL_AWB #1008936572891_pdf.exeRegAsm.exe

pid process

1628 DHL_AWB #1008936572891_pdf.exe
1628 DHL_AWB #1008936572891_pdf.exe
1628 DHL_AWB #1008936572891_pdf.exe
4012 RegAsm.exe
4012 RegAsm.exe

flow	ioc
15	checkip.dyndns.org
17	freegeoip.app
18	freegeoip.app

description	pid	process	target process
PID 1628 set thread context of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe

pid	pid_target	process	target process
208	4928	WerFault.exe	dup.exe

pid	process
1628	DHL_AWB #1008936572891_pdf.exe
1628	DHL_AWB #1008936572891_pdf.exe
1628	DHL_AWB #1008936572891_pdf.exe
4012	RegAsm.exe
4012	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL_AWB #1008936572891_pdf.exedup.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1628	DHL_AWB #1008936572891_pdf.exe
Token: SeDebugPrivilege	4928	dup.exe
Token: SeDebugPrivilege	4012	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

DHL_AWB #1008936572891_pdf.exe

description	pid	process	target process
PID 1628 wrote to memory of 4928	1628	DHL_AWB #1008936572891_pdf.exe	dup.exe
PID 1628 wrote to memory of 4928	1628	DHL_AWB #1008936572891_pdf.exe	dup.exe
PID 1628 wrote to memory of 4928	1628	DHL_AWB #1008936572891_pdf.exe	dup.exe
PID 1628 wrote to memory of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe
PID 1628 wrote to memory of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe
PID 1628 wrote to memory of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe
PID 1628 wrote to memory of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe
PID 1628 wrote to memory of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe
PID 1628 wrote to memory of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe
PID 1628 wrote to memory of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe
PID 1628 wrote to memory of 4012	1628	DHL_AWB #1008936572891_pdf.exe	RegAsm.exe

outlook_office_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\DHL_AWB #1008936572891_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_AWB #1008936572891_pdf.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dup.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dup.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 2064
3⤵
- Program crash
PID:208

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4928 -ip 4928
1⤵
PID:4880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Filesize
63KB

MD5
0d5df43af2916f47d00c1573797c1a13

SHA1
230ab5559e806574d26b4c20847c368ed55483b0

SHA256
c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

SHA512
f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Filesize
63KB

MD5
0d5df43af2916f47d00c1573797c1a13

SHA1
230ab5559e806574d26b4c20847c368ed55483b0

SHA256
c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

SHA512
f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dup.exe
Filesize
437KB

MD5
a00d79da5aabd341cbec7060bcf9ecd2

SHA1
c889f6bf15609d30148784f3b588fe2dc2b27aaf

SHA256
2c7a809f39f6e82b2d2aec711f6a994a39d9868ecca6d522ed1bc6b62e87c4a1

SHA512
edcf708321b16d359e1bbaeb6ef92589b49722f711dfb0a27e978bd3731b202686a057dfd18ec44ad5f870c00a495b5f5583f3e0227f86d17baf8e2f6956ffb3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dup.exe
Filesize
437KB

MD5
a00d79da5aabd341cbec7060bcf9ecd2

SHA1
c889f6bf15609d30148784f3b588fe2dc2b27aaf

SHA256
2c7a809f39f6e82b2d2aec711f6a994a39d9868ecca6d522ed1bc6b62e87c4a1

SHA512
edcf708321b16d359e1bbaeb6ef92589b49722f711dfb0a27e978bd3731b202686a057dfd18ec44ad5f870c00a495b5f5583f3e0227f86d17baf8e2f6956ffb3

Download Submit
memory/1628-131-0x0000000005E30000-0x00000000063D4000-memory.dmp

Filesize
5.6MB

Download
memory/1628-132-0x0000000005960000-0x00000000059F2000-memory.dmp

Filesize
584KB

Download
memory/1628-130-0x00000000004E0000-0x0000000000664000-memory.dmp

Filesize
1.5MB

Download
memory/4012-140-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4012-143-0x00000000068F0000-0x0000000006940000-memory.dmp

Filesize
320KB

Download
memory/4012-139-0x0000000000000000-mapping.dmp

Download
memory/4928-133-0x0000000000000000-mapping.dmp

Download
memory/4928-138-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/4928-137-0x0000000005470000-0x000000000550C000-memory.dmp

Filesize
624KB

Download
memory/4928-136-0x0000000000B30000-0x0000000000BA4000-memory.dmp

Filesize
464KB

Download