agenttesla | f8baf9ed7a5a0a111ee258ff480db7904a0df836310fac26aa2820f4eb9d18ca

General

Target
SOA.exe
Size 512KB
Sample220521-n456psefc4
SHA256 229082e6470957bbc79991b39d292de7465999a94311c23fc0c2c03035ae42c3
MD5 c7b589b2c0ee8d2012007bf390786745
SHA1 b7d88731a5d9993772693715a713a15c48c33316
SHA512 cc051b504a0837b5d18023361aece8b6ff5532a1f5f9a224aa587a2521ee4a4cad8e02591bd97358e79598f255e4e322066da45363af488fdd97bd00c1f15eb9
MD5 SHA1 SHA512

Score

10^/10

agenttesla snakebot collection keylogger snakebot spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
mpjw2013

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
SnakeBOT
SnakeBOT is a heavily obfuscated .NET downloader.
snakebot

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4848-136-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Contains SnakeBOT related strings 1 IoCs

snakebot

resource	yara_rule
behavioral2/memory/2672-130-0x0000000000BC0000-0x0000000000C4A000-memory.dmp	snakebot_strings

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 4848	2672	SOA.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	RegSvcs.exe
4848	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	SOA.exe
Token: SeDebugPrivilege	4848	RegSvcs.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2672	SOA.exe
2672	SOA.exe
4848	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 4848	2672	SOA.exe	82
PID 2672 wrote to memory of 4848	2672	SOA.exe	82
PID 2672 wrote to memory of 4848	2672	SOA.exe	82
PID 2672 wrote to memory of 4848	2672	SOA.exe	82
PID 2672 wrote to memory of 4848	2672	SOA.exe	82
PID 2672 wrote to memory of 4848	2672	SOA.exe	82
PID 2672 wrote to memory of 4848	2672	SOA.exe	82
PID 2672 wrote to memory of 4848	2672	SOA.exe	82
PID 4848 wrote to memory of 528	4848	RegSvcs.exe	90
PID 4848 wrote to memory of 528	4848	RegSvcs.exe	90
PID 4848 wrote to memory of 528	4848	RegSvcs.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4848
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-130-0x0000000000BC0000-0x0000000000C4A000-memory.dmp

Download

memory/2672-131-0x0000000008060000-0x0000000008604000-memory.dmp

Download

memory/2672-132-0x0000000007B50000-0x0000000007BE2000-memory.dmp

Download

memory/2672-133-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

Download

memory/2672-134-0x000000000B0D0000-0x000000000B16C000-memory.dmp

Download

memory/4848-136-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4848-137-0x0000000005540000-0x00000000055A6000-memory.dmp

Download

memory/4848-139-0x0000000006460000-0x00000000064B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads