agenttesla | 21aeef1143995fb050b42f9a93e8852996815350fb21ed0b5e6e7a5dd880b482

General

Target

Invoice.exe
Size

790KB
MD5

a190b2ff24d2c48c0a559e5721f0707b
SHA1

ca664df590e439bb7f257d0948c1ba8d95119cbb
SHA256

21aeef1143995fb050b42f9a93e8852996815350fb21ed0b5e6e7a5dd880b482
SHA512

ce6f22152f7e5b83d9252962201136e4963612ab598e5f2b22b02adb35aa6485c235450f96f675d7ad1f178067f56f4f5745a23a65b14e11b5d436a0479f3469
SSDEEP

12288:dBXCWFYHrpMc6xbmHwEi6ulLOGPq+bjQQzA9e:6dMLxCHriDZB1bjZzA

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.pisc.lk
Port:
587
Username:
[email protected]
Password:
PIsafeTY2021

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Invoice.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Invoice.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Invoice.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Invoice.exe

description pid process target process

PID 944 set thread context of 3384 944 Invoice.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4080 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Invoice.exepowershell.exeRegSvcs.exe

pid process

944 Invoice.exe
3984 powershell.exe
944 Invoice.exe
3384 RegSvcs.exe
3384 RegSvcs.exe
3984 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Invoice.exepowershell.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 944 Invoice.exe
Token: SeDebugPrivilege 3984 powershell.exe
Token: SeDebugPrivilege 3384 RegSvcs.exe

description	pid	process	target process
PID 944 set thread context of 3384	944	Invoice.exe	RegSvcs.exe

pid	process
4080	schtasks.exe

pid	process
944	Invoice.exe
3984	powershell.exe
944	Invoice.exe
3384	RegSvcs.exe
3384	RegSvcs.exe
3984	powershell.exe

description	pid	process
Token: SeDebugPrivilege	944	Invoice.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	3384	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Invoice.exe

description	pid	process	target process
PID 944 wrote to memory of 3984	944	Invoice.exe	powershell.exe
PID 944 wrote to memory of 3984	944	Invoice.exe	powershell.exe
PID 944 wrote to memory of 3984	944	Invoice.exe	powershell.exe
PID 944 wrote to memory of 4080	944	Invoice.exe	schtasks.exe
PID 944 wrote to memory of 4080	944	Invoice.exe	schtasks.exe
PID 944 wrote to memory of 4080	944	Invoice.exe	schtasks.exe
PID 944 wrote to memory of 3384	944	Invoice.exe	RegSvcs.exe
PID 944 wrote to memory of 3384	944	Invoice.exe	RegSvcs.exe
PID 944 wrote to memory of 3384	944	Invoice.exe	RegSvcs.exe
PID 944 wrote to memory of 3384	944	Invoice.exe	RegSvcs.exe
PID 944 wrote to memory of 3384	944	Invoice.exe	RegSvcs.exe
PID 944 wrote to memory of 3384	944	Invoice.exe	RegSvcs.exe
PID 944 wrote to memory of 3384	944	Invoice.exe	RegSvcs.exe
PID 944 wrote to memory of 3384	944	Invoice.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EAQYFApq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EAQYFApq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8CBF.tmp"
2⤵
- Creates scheduled task(s)
PID:4080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8CBF.tmp
Filesize
1KB

MD5
88c615e032b605df1b37f454957fad6d

SHA1
4f60843be4c609f3fe02ebc852718f86a2a7ee50

SHA256
584f3a40cef1f8b133a0f04b78d66951e59060bde252597e4e14df22634b48f7

SHA512
2f42a0487e63721e2336052aa56b49d37745e1d5eb6a86bff75c56d8217c9a8ff640bcff011873c2a3797ba1242ea3c665ae4b26139a5ff6d8f82b7c0c86d018

Download Submit
memory/944-133-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/944-134-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Filesize
584KB

Download
memory/944-135-0x0000000004C30000-0x0000000004C3A000-memory.dmp

Filesize
40KB

Download
memory/944-136-0x0000000007690000-0x000000000772C000-memory.dmp

Filesize
624KB

Download
memory/944-137-0x0000000007AA0000-0x0000000007B06000-memory.dmp

Filesize
408KB

Download
memory/944-132-0x00000000001C0000-0x000000000028C000-memory.dmp

Filesize
816KB

Download
memory/3384-143-0x0000000000000000-mapping.dmp

Download
memory/3384-154-0x0000000006860000-0x00000000068B0000-memory.dmp

Filesize
320KB

Download
memory/3384-144-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3984-145-0x0000000005F00000-0x0000000005F22000-memory.dmp

Filesize
136KB

Download
memory/3984-151-0x0000000008070000-0x00000000086EA000-memory.dmp

Filesize
6.5MB

Download
memory/3984-140-0x0000000005100000-0x0000000005136000-memory.dmp

Filesize
216KB

Download
memory/3984-158-0x0000000007D40000-0x0000000007D48000-memory.dmp

Filesize
32KB

Download
memory/3984-146-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/3984-147-0x0000000006710000-0x000000000672E000-memory.dmp

Filesize
120KB

Download
memory/3984-148-0x00000000076D0000-0x0000000007702000-memory.dmp

Filesize
200KB

Download
memory/3984-149-0x00000000702E0000-0x000000007032C000-memory.dmp

Filesize
304KB

Download
memory/3984-150-0x0000000006CD0000-0x0000000006CEE000-memory.dmp

Filesize
120KB

Download
memory/3984-142-0x0000000005770000-0x0000000005D98000-memory.dmp

Filesize
6.2MB

Download
memory/3984-152-0x0000000007A20000-0x0000000007A3A000-memory.dmp

Filesize
104KB

Download
memory/3984-153-0x0000000007A90000-0x0000000007A9A000-memory.dmp

Filesize
40KB

Download
memory/3984-155-0x0000000007CA0000-0x0000000007D36000-memory.dmp

Filesize
600KB

Download
memory/3984-138-0x0000000000000000-mapping.dmp

Download
memory/3984-156-0x0000000007C50000-0x0000000007C5E000-memory.dmp

Filesize
56KB

Download
memory/3984-157-0x0000000007D60000-0x0000000007D7A000-memory.dmp

Filesize
104KB

Download
memory/4080-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads