agenttesla | e6b02b928df9d97c74da7d2db792fdc1dc06f65b5c3ea179171391f870ec6cf0

Analysis

max time kernel
138s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2022, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FOLLOW UP PAYMENT.exe
Size 577KB
Sample220722-hjl97sdcf3
SHA256 44ac93233199a7bc7e6f17be959844e6448f4e612f7f71909f2dfd41c3b388a7
MD5 9616ca400b972668c6642ebf632b3fa3
SHA1 88530fc14e1f7cb7600258dff9e9980f9e952df3
SHA512 279d7a1b2714f2906f3872120f626949fb0c022a32610c841dee09741b762084864ac44f84a00b70c0e0ecdb24396ffab44aa4006da95e678f93585ac0d56543
MD5 SHA1 SHA512

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot5357159221:AAEuOoQ0pUc4ccIZou0EJ5Zin0mMneE2jYg/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yqWDN = "C:\\Users\\Admin\\AppData\\Roaming\\yqWDN\\yqWDN.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4700 set thread context of 220	4700	FOLLOW UP PAYMENT.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4700	FOLLOW UP PAYMENT.exe
4700	FOLLOW UP PAYMENT.exe
220	RegSvcs.exe
220	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	FOLLOW UP PAYMENT.exe
Token: SeDebugPrivilege	220	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3556	4700	FOLLOW UP PAYMENT.exe	78
PID 4700 wrote to memory of 3556	4700	FOLLOW UP PAYMENT.exe	78
PID 4700 wrote to memory of 3556	4700	FOLLOW UP PAYMENT.exe	78
PID 4700 wrote to memory of 220	4700	FOLLOW UP PAYMENT.exe	79
PID 4700 wrote to memory of 220	4700	FOLLOW UP PAYMENT.exe	79
PID 4700 wrote to memory of 220	4700	FOLLOW UP PAYMENT.exe	79
PID 4700 wrote to memory of 220	4700	FOLLOW UP PAYMENT.exe	79
PID 4700 wrote to memory of 220	4700	FOLLOW UP PAYMENT.exe	79
PID 4700 wrote to memory of 220	4700	FOLLOW UP PAYMENT.exe	79
PID 4700 wrote to memory of 220	4700	FOLLOW UP PAYMENT.exe	79
PID 4700 wrote to memory of 220	4700	FOLLOW UP PAYMENT.exe	79

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\FOLLOW UP PAYMENT.exe
"C:\Users\Admin\AppData\Local\Temp\FOLLOW UP PAYMENT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:3556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-137-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/220-138-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download

memory/220-139-0x00000000062E0000-0x0000000006330000-memory.dmp

Download

memory/4700-130-0x00000000004C0000-0x0000000000556000-memory.dmp

Download

memory/4700-131-0x0000000005520000-0x0000000005AC4000-memory.dmp

Download

memory/4700-132-0x0000000004F70000-0x0000000005002000-memory.dmp

Download

memory/4700-133-0x0000000005010000-0x00000000050AC000-memory.dmp

Download

memory/4700-134-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Download