agenttesla | 21aeef1143995fb050b42f9a93e8852996815350fb21ed0b5e6e7a5dd880b482

General

Target

Invoice.exe
Size

790KB
MD5

a190b2ff24d2c48c0a559e5721f0707b
SHA1

ca664df590e439bb7f257d0948c1ba8d95119cbb
SHA256

21aeef1143995fb050b42f9a93e8852996815350fb21ed0b5e6e7a5dd880b482
SHA512

ce6f22152f7e5b83d9252962201136e4963612ab598e5f2b22b02adb35aa6485c235450f96f675d7ad1f178067f56f4f5745a23a65b14e11b5d436a0479f3469
SSDEEP

12288:dBXCWFYHrpMc6xbmHwEi6ulLOGPq+bjQQzA9e:6dMLxCHriDZB1bjZzA

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.pisc.lk
Port:
587
Username:
sales@pisc.lk
Password:
PIsafeTY2021

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Invoice.exe

description pid process target process

PID 1268 set thread context of 744 1268 Invoice.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1528 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Invoice.exeRegSvcs.exepowershell.exe

pid process

1268 Invoice.exe
1268 Invoice.exe
744 RegSvcs.exe
744 RegSvcs.exe
848 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Invoice.exeRegSvcs.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1268 Invoice.exe
Token: SeDebugPrivilege 744 RegSvcs.exe
Token: SeDebugPrivilege 848 powershell.exe

description	pid	process	target process
PID 1268 set thread context of 744	1268	Invoice.exe	RegSvcs.exe

pid	process
1528	schtasks.exe

pid	process
1268	Invoice.exe
1268	Invoice.exe
744	RegSvcs.exe
744	RegSvcs.exe
848	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1268	Invoice.exe
Token: SeDebugPrivilege	744	RegSvcs.exe
Token: SeDebugPrivilege	848	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Invoice.exe

description	pid	process	target process
PID 1268 wrote to memory of 848	1268	Invoice.exe	powershell.exe
PID 1268 wrote to memory of 848	1268	Invoice.exe	powershell.exe
PID 1268 wrote to memory of 848	1268	Invoice.exe	powershell.exe
PID 1268 wrote to memory of 848	1268	Invoice.exe	powershell.exe
PID 1268 wrote to memory of 1528	1268	Invoice.exe	schtasks.exe
PID 1268 wrote to memory of 1528	1268	Invoice.exe	schtasks.exe
PID 1268 wrote to memory of 1528	1268	Invoice.exe	schtasks.exe
PID 1268 wrote to memory of 1528	1268	Invoice.exe	schtasks.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe
PID 1268 wrote to memory of 744	1268	Invoice.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EAQYFApq.exe"
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EAQYFApq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC19B.tmp"
- Creates scheduled task(s)
PID:1528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC19B.tmp
Filesize
1KB

MD5
40afca96742a548d165efade409cb3db

SHA1
0f0f24537d9e76a80263e809393bcc276b0bf094

SHA256
8d6b82cf66bc0f225dd309b0c905c1fb1dc98fa58bf27ba5bb4120965cd3747a

SHA512
230d18c04752acfc6c2d0c3adc206654e4f114353e3f735a73d719542aee1729136099fc2f40546c1c806891dc19668aa10f913d4cf1dd8dce998202936d81a2

Download Submit
memory/744-68-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/744-74-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/744-72-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/744-70-0x0000000000435A0E-mapping.dmp

Download
memory/744-69-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/744-64-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/744-65-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/744-67-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/848-77-0x000000006E540000-0x000000006EAEB000-memory.dmp

Filesize
5MB

Download
memory/848-76-0x000000006E540000-0x000000006EAEB000-memory.dmp

Filesize
5MB

Download
memory/848-59-0x0000000000000000-mapping.dmp

Download
memory/1268-58-0x0000000005480000-0x0000000005512000-memory.dmp

Filesize
584KB

Download
memory/1268-63-0x0000000004760000-0x000000000479A000-memory.dmp

Filesize
232KB

Download
memory/1268-54-0x0000000000FC0000-0x000000000108C000-memory.dmp

Filesize
816KB

Download
memory/1268-57-0x0000000000770000-0x000000000077C000-memory.dmp

Filesize
48KB

Download
memory/1268-56-0x0000000000550000-0x0000000000564000-memory.dmp

Filesize
80KB

Download
memory/1268-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1528-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads