agenttesla | e3b3af077863c5317d69fdebb734879d3d716f431b8168903069dfe8d3c77d68

General

Target

New-Order_1591158608495.pdf.exe
Size

576KB
MD5

044c08bc06afcfee4ef1cd2a5e954f1b
SHA1

0bde6f8697530bb9338d0428f4cda4f4ecb9b064
SHA256

9edf6d5c0fb37d58053e7b45411d16cc1c63d806d139139e06bc8a2dab4626d8
SHA512

20d64d5a04aeea776c13f879e96b79b3f54a63d1c04bf3b631afa0b06dad797ff07d81d742240b79806e812195f2995ac7f9d8255df3137596546f1c8d2e2295

Score

10^/10

agenttesla collection keylogger persistence rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.aquariuslogistics.com
Port:
587
Username:
ajay@aquariuslogistics.com
Password:
AQL@2019#$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1468-64-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1468-65-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1468-66-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1468-67-0x000000000044833E-mapping.dmp	family_agenttesla
behavioral1/memory/1468-69-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1468-71-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2044-58-0x0000000001F00000-0x0000000001F54000-memory.dmp	rezer0

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

New-Order_1591158608495.pdf.exe

description pid process target process

PID 2044 set thread context of 1468 2044 New-Order_1591158608495.pdf.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1584 schtasks.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

1168 REG.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

New-Order_1591158608495.pdf.exeRegSvcs.exe

pid process

2044 New-Order_1591158608495.pdf.exe
2044 New-Order_1591158608495.pdf.exe
2044 New-Order_1591158608495.pdf.exe
1468 RegSvcs.exe
1468 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

New-Order_1591158608495.pdf.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 2044 New-Order_1591158608495.pdf.exe
Token: SeDebugPrivilege 1468 RegSvcs.exe

description	pid	process	target process
PID 2044 set thread context of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe

pid	process
1584	schtasks.exe

pid	process
1168	REG.exe

pid	process
2044	New-Order_1591158608495.pdf.exe
2044	New-Order_1591158608495.pdf.exe
2044	New-Order_1591158608495.pdf.exe
1468	RegSvcs.exe
1468	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2044	New-Order_1591158608495.pdf.exe
Token: SeDebugPrivilege	1468	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

New-Order_1591158608495.pdf.exeRegSvcs.exe

description	pid	process	target process
PID 2044 wrote to memory of 1584	2044	New-Order_1591158608495.pdf.exe	schtasks.exe
PID 2044 wrote to memory of 1584	2044	New-Order_1591158608495.pdf.exe	schtasks.exe
PID 2044 wrote to memory of 1584	2044	New-Order_1591158608495.pdf.exe	schtasks.exe
PID 2044 wrote to memory of 1584	2044	New-Order_1591158608495.pdf.exe	schtasks.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 2044 wrote to memory of 1468	2044	New-Order_1591158608495.pdf.exe	RegSvcs.exe
PID 1468 wrote to memory of 1168	1468	RegSvcs.exe	REG.exe
PID 1468 wrote to memory of 1168	1468	RegSvcs.exe	REG.exe
PID 1468 wrote to memory of 1168	1468	RegSvcs.exe	REG.exe
PID 1468 wrote to memory of 1168	1468	RegSvcs.exe	REG.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\New-Order_1591158608495.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\New-Order_1591158608495.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pUvphd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F7B.tmp"
2⤵
- Creates scheduled task(s)
PID:1584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1468

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
3⤵
- Modifies registry key
PID:1168

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9F7B.tmp
Filesize
1KB

MD5
bffc8ece9e7107533e5f6c39baf51b89

SHA1
933f73e48859e82720436fe09c352ede8d315c94

SHA256
57c375971f2fc0a7aa9bfe20ae67431e39dc51c15d93184266ff2eb734361da1

SHA512
7bf4576619e81f8a67a969f5cf3ef2528f87e0435382a8f1900b141c757d9d17625dd2ebbc2914cd7e786b5bb51204fa951aa29a8579b0d9a7e20644aee14d4d

Download Submit
memory/1168-73-0x0000000000000000-mapping.dmp

Download
memory/1468-67-0x000000000044833E-mapping.dmp

Download
memory/1468-66-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-71-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-69-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-61-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-62-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-64-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-65-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1584-59-0x0000000000000000-mapping.dmp

Download
memory/2044-56-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/2044-54-0x0000000000850000-0x00000000008E6000-memory.dmp

Filesize
600KB

Download
memory/2044-57-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/2044-58-0x0000000001F00000-0x0000000001F54000-memory.dmp

Filesize
336KB

Download
memory/2044-55-0x0000000001FD0000-0x000000000202A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads