agenttesla | 97c28174a64eab003f2a1b2f4a742acbcbb8394249d136d176c19711908da21a

General

Target

Commercial Invoice.exe
Size

979KB
MD5

b5a0914788f8416e6dabdf9b429dc11c
SHA1

6d16e1f6412532e51d75cadaa8fa69eee4292574
SHA256

97c28174a64eab003f2a1b2f4a742acbcbb8394249d136d176c19711908da21a
SHA512

7e87a469c196df7a6cf51c944463e9c49803b121f940f32186cdde4019e8adcc6369bd15ec7324ad0a3191e13edc6886e331f3a5f64e630f103a378b4e3841e9
SSDEEP

12288:BpUYuX15nN8eY+ceSigcvnvlVQjL9QzX7BIBi8pV4VpQWsNTAzc1NfpHsVfdcn:Cl5W+SM34jJQ5B8pnzTccOI

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.dmstech.in
Port:
587
Username:
[email protected]
Password:
0]6F9Az.pqfd
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\zBwkauB = "C:\\Users\\Admin\\AppData\\Roaming\\zBwkauB\\zBwkauB.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Commercial Invoice.exe

description pid process target process

PID 1980 set thread context of 1172 1980 Commercial Invoice.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

896 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Commercial Invoice.exeRegSvcs.exe

pid process

1980 Commercial Invoice.exe
1172 RegSvcs.exe
1172 RegSvcs.exe
1172 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Commercial Invoice.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1980 Commercial Invoice.exe
Token: SeDebugPrivilege 1172 RegSvcs.exe

description	pid	process	target process
PID 1980 set thread context of 1172	1980	Commercial Invoice.exe	RegSvcs.exe

pid	process
896	schtasks.exe

pid	process
1980	Commercial Invoice.exe
1172	RegSvcs.exe
1172	RegSvcs.exe
1172	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1980	Commercial Invoice.exe
Token: SeDebugPrivilege	1172	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Commercial Invoice.exe

description	pid	process	target process
PID 1980 wrote to memory of 896	1980	Commercial Invoice.exe	schtasks.exe
PID 1980 wrote to memory of 896	1980	Commercial Invoice.exe	schtasks.exe
PID 1980 wrote to memory of 896	1980	Commercial Invoice.exe	schtasks.exe
PID 1980 wrote to memory of 896	1980	Commercial Invoice.exe	schtasks.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe
PID 1980 wrote to memory of 1172	1980	Commercial Invoice.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Commercial Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Commercial Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgmJRFXvDO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAAD1.tmp"
2⤵
- Creates scheduled task(s)
PID:896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAAD1.tmp

Filesize
1KB

MD5
0349ac88eb9ecc95b9419518e5173071

SHA1
8a8919c40a765f7a1d5873c48924315f9a2a6c1a

SHA256
a6359a3ef8c1d18205979d8869d2e50911a0d7d062b65ee7651ab94d6c1a99c5

SHA512
8959a98bd8ce978c193088d3dd386fa9a6eb397d5666f46295dd70d7457f0b2c302de39b1be0c8aabc76de1e3ba5e0731d2104f0b6f9718bcb94d0e9f288ccd9

Download Submit
memory/896-59-0x0000000000000000-mapping.dmp

Download
memory/1172-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1172-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1172-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1172-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1172-67-0x0000000000437C7E-mapping.dmp

Download
memory/1172-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1172-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1172-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1980-57-0x0000000005800000-0x0000000005880000-memory.dmp

Filesize
512KB

Download
memory/1980-58-0x0000000004AA0000-0x0000000004ADC000-memory.dmp

Filesize
240KB

Download
memory/1980-56-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/1980-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1980-54-0x0000000000C40000-0x0000000000D3A000-memory.dmp

Filesize
1000KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads