agenttesla | 4bde9f43841d29ce72a20deec55e7081f0c387ebfcdf24ab2e2af88e298d79d0

Analysis

max time kernel
85s
max time network
69s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AWB & Invoice #1006472.exe
Size 829KB
Sample220720-h8ddladefr
SHA256 0fe48a175b79a47314cc8ef8d5768e0a911e08da6b855faba6b41ec82bdebc4b
MD5 839bc500771a397808b8c7c2c3cd3836
SHA1 7e728b65b9053db0574e0776d05ed4fc566ea6fe
SHA512 e9fa0b6762ec8eb9a981b99a3f08f543efd18b234239d1593ad73e51319482ac5a2658a3b81a4083a0b2e688ed5195ccfbb07cff4be9b009090113dae6d7f508
MD5 SHA1 SHA512

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.artrsllc.com
Port
21
Username
[email protected]
Password
U-m{dfJHMN&q

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.artrsllc.com/
Port
21
Username
[email protected]
Password
U-m{dfJHMN&q

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1676	900	AWB & Invoice #1006472.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
900	AWB & Invoice #1006472.exe
900	AWB & Invoice #1006472.exe
1676	RegSvcs.exe
1676	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	AWB & Invoice #1006472.exe
Token: SeDebugPrivilege	1676	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27
PID 900 wrote to memory of 1676	900	AWB & Invoice #1006472.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\AWB & Invoice #1006472.exe
"C:\Users\Admin\AppData\Local\Temp\AWB & Invoice #1006472.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x00000000003E0000-0x00000000004B6000-memory.dmp

Download

memory/900-55-0x0000000076211000-0x0000000076213000-memory.dmp

Download

memory/900-56-0x00000000005E0000-0x00000000005F6000-memory.dmp

Download

memory/900-57-0x0000000001DF0000-0x0000000001DFA000-memory.dmp

Download

memory/900-58-0x0000000005E20000-0x0000000005ECC000-memory.dmp

Download

memory/900-59-0x0000000004FE0000-0x0000000005058000-memory.dmp

Download

memory/1676-60-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1676-61-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1676-63-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1676-64-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1676-65-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1676-68-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1676-70-0x0000000000400000-0x000000000043A000-memory.dmp

Download