agenttesla | e43659dac9e8276ec4f3948c5211c3c64b34b34307b1ad15681c81529c8b64ae

General

Target

AWB # 1835257406.PDF.exe
Size

966KB
MD5

1a490260d5a847f0f0f0d91d76cd3dba
SHA1

ba58db3865114caa06f58469ccc3d9052b9812b8
SHA256

e43659dac9e8276ec4f3948c5211c3c64b34b34307b1ad15681c81529c8b64ae
SHA512

240a7cc26d59f6f193ebd58420793593f107d582626c32313f2904a8b316b2e22f36c5df2061f0abcedc9f7753dd3d479c4a3c06cd5c8714eac9160c0c19e2f6
SSDEEP

12288:9PhNUJQSHlQhr12iNEpos0ckmPU9Lvnofxgvjrx17sPE3E:VrSHlQhr11E9V8Lvof2jrxqPE3

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5495243543:AAG3XPeGW7yqfXF6_EXjGSfO9SWHJTpqVsU/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\LdtJsTw = "C:\\Users\\Admin\\AppData\\Roaming\\LdtJsTw\\LdtJsTw.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 872 set thread context of 1976	872	AWB # 1835257406.PDF.exe	29

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
872	AWB # 1835257406.PDF.exe
872	AWB # 1835257406.PDF.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	AWB # 1835257406.PDF.exe
Token: SeDebugPrivilege	1976	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1212	872	AWB # 1835257406.PDF.exe	28
PID 872 wrote to memory of 1212	872	AWB # 1835257406.PDF.exe	28
PID 872 wrote to memory of 1212	872	AWB # 1835257406.PDF.exe	28
PID 872 wrote to memory of 1212	872	AWB # 1835257406.PDF.exe	28
PID 872 wrote to memory of 1212	872	AWB # 1835257406.PDF.exe	28
PID 872 wrote to memory of 1212	872	AWB # 1835257406.PDF.exe	28
PID 872 wrote to memory of 1212	872	AWB # 1835257406.PDF.exe	28
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29
PID 872 wrote to memory of 1976	872	AWB # 1835257406.PDF.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\AWB # 1835257406.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\AWB # 1835257406.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:1212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-54-0x0000000000F70000-0x0000000001068000-memory.dmp

Filesize
992KB

Download
memory/872-55-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/872-56-0x0000000000280000-0x0000000000292000-memory.dmp

Filesize
72KB

Download
memory/872-57-0x0000000005510000-0x0000000005596000-memory.dmp

Filesize
536KB

Download
memory/872-58-0x0000000000C10000-0x0000000000C4C000-memory.dmp

Filesize
240KB

Download
memory/1976-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1976-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1976-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1976-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1976-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1976-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1976-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing