agenttesla | a7614db6dcbe0c9a1ade9ac2caec0d1350b78802b5ffa3678ad513ce41ef6d5c

Analysis

max time kernel
100s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2022, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Delivery Invoice.exe
Size 1.1MB
Sample221115-dma9wsef89
SHA256 a7614db6dcbe0c9a1ade9ac2caec0d1350b78802b5ffa3678ad513ce41ef6d5c
MD5 886c6d07ae020f48b3af4dd6357f558e
SHA1 ece6a4754c8655efed335dd795398d6e3417c4d6
SHA512 528761bf6d874f1e81e3a821c61e0b3d0557a92e1f54b4e84eb5f8f8ee8e34a091dc1afe2c8a1f06fa1882aa7ac2dbab0de6d79d3812e8139f5facf7d9281b97
SSDEEP 24576:LAOcZXMuDtwtXGhDCh18p3bjLzCXPQMTjbnNSPu:NwteiDVBnCXYMTnNSPu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
graceofgod@amenn

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

resource	yara_rule
behavioral2/memory/5032-141-0x0000000000500000-0x0000000000AB2000-memory.dmp	family_agenttesla
behavioral2/memory/5032-142-0x0000000000500000-0x000000000053C000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

pid	Process
2884	oxhrtbwct.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Delivery Invoice.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 5032	2884	oxhrtbwct.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	Delivery Invoice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5032	RegSvcs.exe
5032	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 2524	4664	Delivery Invoice.exe	80
PID 4664 wrote to memory of 2524	4664	Delivery Invoice.exe	80
PID 4664 wrote to memory of 2524	4664	Delivery Invoice.exe	80
PID 2524 wrote to memory of 2884	2524	WScript.exe	81
PID 2524 wrote to memory of 2884	2524	WScript.exe	81
PID 2524 wrote to memory of 2884	2524	WScript.exe	81
PID 2884 wrote to memory of 5032	2884	oxhrtbwct.exe	84
PID 2884 wrote to memory of 5032	2884	oxhrtbwct.exe	84
PID 2884 wrote to memory of 5032	2884	oxhrtbwct.exe	84
PID 2884 wrote to memory of 5032	2884	oxhrtbwct.exe	84
PID 2884 wrote to memory of 5032	2884	oxhrtbwct.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Delivery Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Delivery Invoice.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\6_34\vkkamcpx.vbe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\6_34\oxhrtbwct.exe
    "C:\Users\Admin\AppData\Local\Temp\6_34\oxhrtbwct.exe" ekfhjofdk.bmp
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      outlook_office_path
      outlook_win_path
      PID:5032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

awjv.vbi

Path C:\Users\Admin\AppData\Local\Temp\6_34\awjv.vbi
Size 431KB
SHA256 6b2daecae5b45dca5cede5ea053af23c314517831c7dca88b23879f0c18d6bb5
MD5 f0baf74bc8797ed05db8099d4e05d6c8
SHA1 2ad5117b6d57a55d1e054d9f88f7b4fb11fec7cb
SHA512 4fa8ecd540da3a002a84770c1f7e9155a2afe6a07cb3e5706f56fb67a4b0f4d0a07b8437e11a98d73a11cad3ea52b61aa8527839b864c168458bfcc30d75c4a0
SSDEEP 6144:qND6xBLIvsWZLSj4dT1TsjHf6L9e9EXpED3JakNy/t6Z+:qNDMBLIEmK4dTts+peIED5aecQ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ekfhjofdk.bmp

Path C:\Users\Admin\AppData\Local\Temp\6_34\ekfhjofdk.bmp
Size 77.9MB
SHA256 32d914b1b4f7c1305becfb303811a1a9754f2312470826feb8e565f3766eedc9
MD5 49c015ec2e809a1947e5c1a089c7c9b2
SHA1 7d801c72788444784bd947d9f078752f251d6889
SHA512 7ddfbb20b23d8ca374d837b30e1777585a29a486f310843ccf3976907b5c17d62a499a70e0efb7b91bbfaec24cdb0039073fb79019a6d5d1dccbeb6557039927
SSDEEP 196608:ANxo8OY1Vod1T4oG0ghGSDvcSXLm1ad4rNxZUWENRNWx+cvXuP4rq/Uj3eqx2SGP:y
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxhrtbwct.exe

Path C:\Users\Admin\AppData\Local\Temp\6_34\oxhrtbwct.exe
Size 1.1MB
SHA256 f71a98c04bd6302432ed074d4574cb956932692c2952bb73d11af26cda093d15
MD5 0fb0aade9afdcad4052df8ca70119a1c
SHA1 dfcd0b987a197391964f2fb7390119c4134796f3
SHA512 2f3a760ebd3ea695417340a8fc7888f742d411e97728efa82fa566dc526417b6127a6029ac2221e095723c8622dbed7b9cef0fd9a7ebdbd9ca2e3240096210a9
SSDEEP 24576:XYgAon+KfqNbXD2XJ2PH1ddATgs/u2ka8XjMeJ:X37+KSbq5e1diEnHa8Xjr
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxhrtbwct.exe

Path C:\Users\Admin\AppData\Local\Temp\6_34\oxhrtbwct.exe
Size 1.1MB
SHA256 f71a98c04bd6302432ed074d4574cb956932692c2952bb73d11af26cda093d15
MD5 0fb0aade9afdcad4052df8ca70119a1c
SHA1 dfcd0b987a197391964f2fb7390119c4134796f3
SHA512 2f3a760ebd3ea695417340a8fc7888f742d411e97728efa82fa566dc526417b6127a6029ac2221e095723c8622dbed7b9cef0fd9a7ebdbd9ca2e3240096210a9
SSDEEP 24576:XYgAon+KfqNbXD2XJ2PH1ddATgs/u2ka8XjMeJ:X37+KSbq5e1diEnHa8Xjr
MD5 SHA1 SHA512 SSDEEP

Submit Download

umrjurefr.xml

Path C:\Users\Admin\AppData\Local\Temp\6_34\umrjurefr.xml
Size 45KB
SHA256 9bc84b4e5ffe1d3ccf37ab7526e55ac83bfc6264771844dd57d89e4426a58023
MD5 017c82e66cc253a3fca2c16f7154d259
SHA1 08d0468dfe2764267fc85fb91ea409aa6d1b1504
SHA512 d46e65e2df56805ce9e3e5109c672c40f662e915b8115b7a2ed8bea024f6eff17c1c7e0be80e02cd0730caee59535a2d6f3649666caa2726081b5ebfbdecd8e8
SSDEEP 768:5iGbjkt4hTYpZN1L0ErxpfqCjOuY9Khi2/jS7Z6fgSrnCslxpbZ5lDjIZycV:HnhcpSErvqz0xSF6d3xpbRDjZcV
MD5 SHA1 SHA512 SSDEEP

Submit Download

vkkamcpx.vbe

Path C:\Users\Admin\AppData\Local\temp\6_34\vkkamcpx.vbe
Size 45KB
SHA256 73eccdd78b8613612c14ff093a1ac0b4c2fbb132dae81265fb069958b9df90c9
MD5 6140b44eae52b76a3c06613125a2fc83
SHA1 d4ae845e7e07bd4ba2f2861edafeb63f192eb773
SHA512 bd1d9f6e6ed4a6994c4ec3cd474829c9e6a52341cbf6f1c449620c451ffb20b335ea817d695e262f1b51cd7c1244bd8ca50dc468bc361af94f7353c32623de39
SSDEEP 768:fPE8PEXPEXPEXPEAPEIPEhPE8oPEqtPEo:ntwwwZ5Sar7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5032-141-0x0000000000500000-0x0000000000AB2000-memory.dmp

Download

memory/5032-142-0x0000000000500000-0x000000000053C000-memory.dmp

Download

memory/5032-143-0x0000000005650000-0x0000000005BF4000-memory.dmp

Download

memory/5032-144-0x00000000050A0000-0x0000000005132000-memory.dmp

Download

memory/5032-145-0x0000000005330000-0x00000000053CC000-memory.dmp

Download

memory/5032-146-0x0000000006040000-0x00000000060A6000-memory.dmp

Download

memory/5032-147-0x00000000063D0000-0x0000000006420000-memory.dmp

Download

memory/5032-148-0x0000000006360000-0x000000000636A000-memory.dmp

Download