agenttesla | aa03fe484ef1ecfcf467e1940aff0af9ce3ca61329f461eeabcfa58caeaf65fa

General

Target

8vP60HbFlryaXUJ.exe
Size

698KB
MD5

749dd3529f51598cf860e00ec94c93bd
SHA1

80c6b3e55d64d6e070b8e365adb4bf2fef48461e
SHA256

aa03fe484ef1ecfcf467e1940aff0af9ce3ca61329f461eeabcfa58caeaf65fa
SHA512

b7ff639fa1367840e5694b7e60b1cc35131c27c82b8d489beb0f3b80d14beb0946392c9c4bd24db947c12ca5050b2841cc12017e20d766c402e4d8463d495b35
SSDEEP

12288:Ga7dddl4MvM08zrbETCl6gIRDPHsAOKu8FX7XCr/uaFzkkFg/IyXCD8Hk5:GaZv1U0876C8gEDH77FXL6maqkFg/IyG

Score

10^/10

agenttesla collection evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mktron.in
Port:
587
Username:
[email protected]
Password:
VZZUQXTDyMCZ
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

8vP60HbFlryaXUJ.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 8vP60HbFlryaXUJ.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

8vP60HbFlryaXUJ.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 8vP60HbFlryaXUJ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	8vP60HbFlryaXUJ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	8vP60HbFlryaXUJ.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8vP60HbFlryaXUJ.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8vP60HbFlryaXUJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8vP60HbFlryaXUJ.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8vP60HbFlryaXUJ.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8vP60HbFlryaXUJ.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yGbzOMp = "C:\\Users\\Admin\\AppData\\Roaming\\yGbzOMp\\yGbzOMp.exe"	RegSvcs.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

8vP60HbFlryaXUJ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8vP60HbFlryaXUJ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	8vP60HbFlryaXUJ.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8vP60HbFlryaXUJ.exe

description pid process target process

PID 4848 set thread context of 1272 4848 8vP60HbFlryaXUJ.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1740 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

8vP60HbFlryaXUJ.exeRegSvcs.exe

pid process

4848 8vP60HbFlryaXUJ.exe
1272 RegSvcs.exe
1272 RegSvcs.exe
1272 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8vP60HbFlryaXUJ.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 4848 8vP60HbFlryaXUJ.exe
Token: SeDebugPrivilege 1272 RegSvcs.exe

description	pid	process	target process
PID 4848 set thread context of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe

pid	process
1740	schtasks.exe

pid	process
4848	8vP60HbFlryaXUJ.exe
1272	RegSvcs.exe
1272	RegSvcs.exe
1272	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4848	8vP60HbFlryaXUJ.exe
Token: SeDebugPrivilege	1272	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

8vP60HbFlryaXUJ.exe

description	pid	process	target process
PID 4848 wrote to memory of 1740	4848	8vP60HbFlryaXUJ.exe	schtasks.exe
PID 4848 wrote to memory of 1740	4848	8vP60HbFlryaXUJ.exe	schtasks.exe
PID 4848 wrote to memory of 1740	4848	8vP60HbFlryaXUJ.exe	schtasks.exe
PID 4848 wrote to memory of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 4848 wrote to memory of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 4848 wrote to memory of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 4848 wrote to memory of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 4848 wrote to memory of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 4848 wrote to memory of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 4848 wrote to memory of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe
PID 4848 wrote to memory of 1272	4848	8vP60HbFlryaXUJ.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\8vP60HbFlryaXUJ.exe
"C:\Users\Admin\AppData\Local\Temp\8vP60HbFlryaXUJ.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\idvuBcNUb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp75FB.tmp"
2⤵
- Creates scheduled task(s)
PID:1740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp75FB.tmp
Filesize
1KB

MD5
8d9d40bdd92e82b37c9dda0f19609b60

SHA1
f4faf52aba778daa0995422d19a6c4fb6e8dcf9e

SHA256
1196092a28f82f2b5a182ea0a738d618ebf1cef052cf7e634fb88ad55c2d031b

SHA512
19e2695f8315415b69c8b9fa8f6881ab5c01ed6aa5d63a9109af4a70f177f56c48a25814668327912f24fafef0b5ee7abb6a37b45b038bb9c1773a587165ea8b

Download Submit
memory/1272-140-0x0000000000000000-mapping.dmp

Download
memory/1272-141-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1272-142-0x0000000005ED0000-0x0000000005F20000-memory.dmp

Filesize
320KB

Download
memory/1740-138-0x0000000000000000-mapping.dmp

Download
memory/4848-132-0x0000000000A30000-0x0000000000AE4000-memory.dmp

Filesize
720KB

Download
memory/4848-133-0x0000000005B00000-0x00000000060A4000-memory.dmp

Filesize
5.6MB

Download
memory/4848-134-0x0000000005470000-0x0000000005502000-memory.dmp

Filesize
584KB

Download
memory/4848-135-0x00000000055F0000-0x000000000568C000-memory.dmp

Filesize
624KB

Download
memory/4848-136-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/4848-137-0x000000000EAD0000-0x000000000EB36000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads