agenttesla | 202e4676713e980f9bef2b8b87f34f90cdd2dff657920e928e550eab3d745b58

Analysis

max time kernel
72s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Proforma invoices.exe
Size 1.1MB
Sample221027-splkzacef5
SHA256 202e4676713e980f9bef2b8b87f34f90cdd2dff657920e928e550eab3d745b58
MD5 9f9468005200d1635f500dca704f1785
SHA1 22df2958bbabcdc7e3f86f28910db8454d3005d9
SHA512 5f577b344069dd1b095cc60b9937cd97579d26f72b241ad88ffd25c2cca8a192f0ce27e92b919c48aa4ed0635cf5b73882802db016e40c8f50ffeee04decc784
SSDEEP 24576:c+4OA6w+NGorX3g39HbPXxcPQpyJK9E7p:c9OA6w+NGob3G7PNIJK9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot1507062795:AAEBb0H5OYbp-dWwXk8ffQp0InjOhKxhpbU/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\SsLtblq = "C:\\Users\\Admin\\AppData\\Roaming\\SsLtblq\\SsLtblq.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 1720	1680	Proforma invoices.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1680	Proforma invoices.exe
1720	RegSvcs.exe
1720	RegSvcs.exe
1720	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	Proforma invoices.exe
Token: SeDebugPrivilege	1720	RegSvcs.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1756	1680	Proforma invoices.exe	28
PID 1680 wrote to memory of 1756	1680	Proforma invoices.exe	28
PID 1680 wrote to memory of 1756	1680	Proforma invoices.exe	28
PID 1680 wrote to memory of 1756	1680	Proforma invoices.exe	28
PID 1680 wrote to memory of 1476	1680	Proforma invoices.exe	30
PID 1680 wrote to memory of 1476	1680	Proforma invoices.exe	30
PID 1680 wrote to memory of 1476	1680	Proforma invoices.exe	30
PID 1680 wrote to memory of 1476	1680	Proforma invoices.exe	30
PID 1680 wrote to memory of 1476	1680	Proforma invoices.exe	30
PID 1680 wrote to memory of 1476	1680	Proforma invoices.exe	30
PID 1680 wrote to memory of 1476	1680	Proforma invoices.exe	30
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31
PID 1680 wrote to memory of 1720	1680	Proforma invoices.exe	31

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Proforma invoices.exe
"C:\Users\Admin\AppData\Local\Temp\Proforma invoices.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtFKvjRVUy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B4B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:1476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5B4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5B4B.tmp
Size 1KB
SHA256 622a48605ba80700d17eb638a706cefc18622866870f659f10120b5dc12e3162
MD5 22e43066c2f7a744c8100d1b3998bd59
SHA1 3bfee35f2fe142c9e9827c5481e1fc7c97f5e57c
SHA512 4dae8da108537905632cf0edc44c9a2eee203a89a0ba089abc59889d2ee43abcaecfca96aa0171f874d1b96030cc596d34d7008403df5da5ad28769c99cf02b9
MD5 SHA1 SHA512

Submit Download

memory/1680-57-0x0000000005730000-0x00000000057B2000-memory.dmp

Download

memory/1680-55-0x0000000075281000-0x0000000075283000-memory.dmp

Download

memory/1680-54-0x0000000001140000-0x0000000001254000-memory.dmp

Download

memory/1680-58-0x0000000000920000-0x000000000095C000-memory.dmp

Download

memory/1680-56-0x0000000000240000-0x0000000000252000-memory.dmp

Download

memory/1720-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1720-61-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1720-62-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1720-64-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1720-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1720-69-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1720-71-0x0000000000400000-0x000000000043C000-memory.dmp

Download