agenttesla | aa03fe484ef1ecfcf467e1940aff0af9ce3ca61329f461eeabcfa58caeaf65fa

General

Target

8vP60HbFlryaXUJ.exe
Size

698KB
MD5

749dd3529f51598cf860e00ec94c93bd
SHA1

80c6b3e55d64d6e070b8e365adb4bf2fef48461e
SHA256

aa03fe484ef1ecfcf467e1940aff0af9ce3ca61329f461eeabcfa58caeaf65fa
SHA512

b7ff639fa1367840e5694b7e60b1cc35131c27c82b8d489beb0f3b80d14beb0946392c9c4bd24db947c12ca5050b2841cc12017e20d766c402e4d8463d495b35
SSDEEP

12288:Ga7dddl4MvM08zrbETCl6gIRDPHsAOKu8FX7XCr/uaFzkkFg/IyXCD8Hk5:GaZv1U0876C8gEDH77FXL6maqkFg/IyG

Score

10^/10

agenttesla collection evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mktron.in
Port:
587
Username:
[email protected]
Password:
VZZUQXTDyMCZ
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

8vP60HbFlryaXUJ.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions 8vP60HbFlryaXUJ.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

8vP60HbFlryaXUJ.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 8vP60HbFlryaXUJ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	8vP60HbFlryaXUJ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	8vP60HbFlryaXUJ.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8vP60HbFlryaXUJ.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8vP60HbFlryaXUJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8vP60HbFlryaXUJ.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yGbzOMp = "C:\\Users\\Admin\\AppData\\Roaming\\yGbzOMp\\yGbzOMp.exe"	RegSvcs.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

8vP60HbFlryaXUJ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8vP60HbFlryaXUJ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	8vP60HbFlryaXUJ.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8vP60HbFlryaXUJ.exe

description pid process target process

PID 1468 set thread context of 1672 1468 8vP60HbFlryaXUJ.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1404 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

8vP60HbFlryaXUJ.exeRegSvcs.exe

pid process

1468 8vP60HbFlryaXUJ.exe
1468 8vP60HbFlryaXUJ.exe
1672 RegSvcs.exe
1672 RegSvcs.exe
1672 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8vP60HbFlryaXUJ.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1468 8vP60HbFlryaXUJ.exe
Token: SeDebugPrivilege 1672 RegSvcs.exe

description	pid	process	target process
PID 1468 set thread context of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe

pid	process
1404	schtasks.exe

pid	process
1468	8vP60HbFlryaXUJ.exe
1468	8vP60HbFlryaXUJ.exe
1672	RegSvcs.exe
1672	RegSvcs.exe
1672	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1468	8vP60HbFlryaXUJ.exe
Token: SeDebugPrivilege	1672	RegSvcs.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

8vP60HbFlryaXUJ.exe

description	pid	process	target process
PID 1468 wrote to memory of 1404	1468	8vP60HbFlryaXUJ.exe	schtasks.exe
PID 1468 wrote to memory of 1404	1468	8vP60HbFlryaXUJ.exe	schtasks.exe
PID 1468 wrote to memory of 1404	1468	8vP60HbFlryaXUJ.exe	schtasks.exe
PID 1468 wrote to memory of 1404	1468	8vP60HbFlryaXUJ.exe	schtasks.exe
PID 1468 wrote to memory of 560	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 560	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 560	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 560	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 560	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 560	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 560	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 1468 wrote to memory of 1672	1468	8vP60HbFlryaXUJ.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\8vP60HbFlryaXUJ.exe
"C:\Users\Admin\AppData\Local\Temp\8vP60HbFlryaXUJ.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\idvuBcNUb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp85B4.tmp"
2⤵
- Creates scheduled task(s)
PID:1404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1672

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp85B4.tmp
Filesize
1KB

MD5
152f9747774a3633e59c59a5273a6274

SHA1
d7506deecf0c21ed72f8acef945904de41f27e2b

SHA256
45800c8d96f16bae9e600a0cf8267758a5e242913586e1ce5604a0c794fdd5aa

SHA512
8b1b825e2434304888656e9d2594f66d59357d710f132c1633f5a2be976fbd098080835fc62cfc05b0b7009b84729baaae3492abaf5ff557eca6e15f96273ee3

Download Submit
memory/1404-59-0x0000000000000000-mapping.dmp

Download
memory/1468-57-0x00000000047F0000-0x0000000004870000-memory.dmp

Filesize
512KB

Download
memory/1468-54-0x0000000000960000-0x0000000000A14000-memory.dmp

Filesize
720KB

Download
memory/1468-58-0x0000000004370000-0x00000000043AC000-memory.dmp

Filesize
240KB

Download
memory/1468-56-0x0000000000930000-0x0000000000942000-memory.dmp

Filesize
72KB

Download
memory/1468-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1672-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1672-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1672-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1672-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1672-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1672-67-0x0000000000437C4E-mapping.dmp

Download
memory/1672-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1672-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads