agenttesla | f282b99dfbccdf631194f38ff4ba62bb9b79d3174a3c4ea6b08f2012110e4ba4

General

Target

PURCHASE ORDER.exe
Size

334KB
MD5

7fef57af049ab9441f9d219f180c2216
SHA1

027a128a7e5a4ad584c062c95759759f8e8616cd
SHA256

6e1b968192bdf51820df2d4c83f322000331ecbf6a1f5e6c91301d2bfdf47637
SHA512

8fec6c1263710c69c83b66b6020a901558ce5c284d2a8f8b0ea7f720576197091ce136efdb427f288266755218a856a747945f9cacb2ce0c20f5efde739b9470

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.wasstech.com
Port:
587
Username:
promotions@wasstech.com
Password:
Sunray2700@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3480-133-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PURCHASE ORDER.exe

description pid process target process

PID 2804 set thread context of 3480 2804 PURCHASE ORDER.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegAsm.exe

pid process

3480 RegAsm.exe
3480 RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

PURCHASE ORDER.exe

pid process

2804 PURCHASE ORDER.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 3480 RegAsm.exe

description	pid	process	target process
PID 2804 set thread context of 3480	2804	PURCHASE ORDER.exe	RegAsm.exe

pid	process
3480	RegAsm.exe
3480	RegAsm.exe

pid	process
2804	PURCHASE ORDER.exe

description	pid	process
Token: SeDebugPrivilege	3480	RegAsm.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PURCHASE ORDER.exe

description	pid	process	target process
PID 2804 wrote to memory of 3480	2804	PURCHASE ORDER.exe	RegAsm.exe
PID 2804 wrote to memory of 3480	2804	PURCHASE ORDER.exe	RegAsm.exe
PID 2804 wrote to memory of 3480	2804	PURCHASE ORDER.exe	RegAsm.exe
PID 2804 wrote to memory of 3480	2804	PURCHASE ORDER.exe	RegAsm.exe

outlook_office_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2804-130-0x0000000000C10000-0x0000000000C6A000-memory.dmp

Filesize
360KB

Download
memory/2804-132-0x0000000002F20000-0x0000000002F23000-memory.dmp

Filesize
12KB

Download
memory/3480-131-0x0000000000000000-mapping.dmp

Download
memory/3480-133-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3480-134-0x0000000005D40000-0x00000000062E4000-memory.dmp

Filesize
5.6MB

Download
memory/3480-135-0x0000000005550000-0x00000000055E2000-memory.dmp

Filesize
584KB

Download
memory/3480-136-0x0000000005830000-0x00000000058CC000-memory.dmp

Filesize
624KB

Download
memory/3480-137-0x00000000063F0000-0x0000000006456000-memory.dmp

Filesize
408KB

Download
memory/3480-138-0x0000000006AA0000-0x0000000006AF0000-memory.dmp

Filesize
320KB

Download
memory/3480-139-0x00000000069C0000-0x00000000069CA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads