agenttesla | 7ed770882e68ffbc46e62f6f6cf20548ece7d42b72ad30228f98e9259d0023fb

General

Target

INVOICE.exe
Size

202KB
MD5

03bf64a83afbaa0f7c65d027d4159caf
SHA1

43b26f8acd97d4d1bee7c4f4c3087b6f197bbe4c
SHA256

7ed770882e68ffbc46e62f6f6cf20548ece7d42b72ad30228f98e9259d0023fb
SHA512

7fd6453845865ee75615f2ebb2ca120e6a398cdb0ef6639e004a9ba5e02d34d6607d746631e13a7c4babca143200e79c55a3668177abd3e72f00e46844511c22
SSDEEP

6144:/Ya6Iwk971blC6pIYBgPiu+PaU4rtQuXpKgv5K:/Y2wy7i6pI0gP2SdWuLxK

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/3136-142-0x0000000000400000-0x0000000000451000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	mohas.exe

Executes dropped EXE 2 IoCs

pid	Process
4784	mohas.exe
3136	mohas.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3136-142-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mohas.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mohas.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mohas.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wwrigu = "C:\\Users\\Admin\\AppData\\Roaming\\adkfbvcdnswsqs\\dfyivdwlnre.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\mohas.exe\" C:\\Users\\Admin\\AppData"	mohas.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4784 set thread context of 3136	4784	mohas.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3136	mohas.exe
3136	mohas.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4784	mohas.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	mohas.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4784	4936	INVOICE.exe	80
PID 4936 wrote to memory of 4784	4936	INVOICE.exe	80
PID 4936 wrote to memory of 4784	4936	INVOICE.exe	80
PID 4784 wrote to memory of 3136	4784	mohas.exe	81
PID 4784 wrote to memory of 3136	4784	mohas.exe	81
PID 4784 wrote to memory of 3136	4784	mohas.exe	81
PID 4784 wrote to memory of 3136	4784	mohas.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mohas.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mohas.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\mohas.exe
  "C:\Users\Admin\AppData\Local\Temp\mohas.exe" C:\Users\Admin\AppData\Local\Temp\bnnvukrqlt.c
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\mohas.exe
    "C:\Users\Admin\AppData\Local\Temp\mohas.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\amxvlok.gmk

Filesize
153KB

MD5
a2b81caf5e9e38041fdd6a26cf7c2662

SHA1
856be07f6cf2ec2c8a577f6bd3699a8b2fcd82f7

SHA256
1b908490d5f7374d39c2e4d81ad2141bc3c18eb51706916f064d1cce5fcc5c7a

SHA512
71c7d3574cc3814133cc8a97046195ab8be45c9158ae1b24a58b6762e1679dabebdca30e43aba7ace7d21244ead5d38933fb8c384f0a0fff12066257f0ee3b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\bnnvukrqlt.c

Filesize
8KB

MD5
47e048b6a962311d71ecf67b15a546a6

SHA1
b20ced22656c8c011ceae42191fcaf73a7a6ea99

SHA256
541729fd7926853d255a0f9174c64e0611f8b07e03174b11c178d2c2db74e4f2

SHA512
b6ec4bac3f7f1efcdfacece7e8989c5fdfe3ea09a93bb81dfd9b952a407d0ab51c99794314cbca5037c9c7155dad2712bde87c543c2eb8691848149477f4f405

Download Submit
C:\Users\Admin\AppData\Local\Temp\mohas.exe

Filesize
5KB

MD5
dd9f794e6a0621a6ff62ff4db609a726

SHA1
9f7cf322a87bfbaffdf3123eedf659c94b9d994d

SHA256
860e7c11c7e6cc0b813b8eb2acb7d6d380ef9f310179516854186b2b8a36cd8a

SHA512
6b4cc6e576744d7b192d3182cd93afb5cf0876bd3189c53a6a5fb6d6477cd217ec1c47c90cd4acc028a65bae10462bd77e6af2b510b022c29df60a1d84eac4a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\mohas.exe

Filesize
5KB

MD5
dd9f794e6a0621a6ff62ff4db609a726

SHA1
9f7cf322a87bfbaffdf3123eedf659c94b9d994d

SHA256
860e7c11c7e6cc0b813b8eb2acb7d6d380ef9f310179516854186b2b8a36cd8a

SHA512
6b4cc6e576744d7b192d3182cd93afb5cf0876bd3189c53a6a5fb6d6477cd217ec1c47c90cd4acc028a65bae10462bd77e6af2b510b022c29df60a1d84eac4a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\mohas.exe

Filesize
5KB

MD5
dd9f794e6a0621a6ff62ff4db609a726

SHA1
9f7cf322a87bfbaffdf3123eedf659c94b9d994d

SHA256
860e7c11c7e6cc0b813b8eb2acb7d6d380ef9f310179516854186b2b8a36cd8a

SHA512
6b4cc6e576744d7b192d3182cd93afb5cf0876bd3189c53a6a5fb6d6477cd217ec1c47c90cd4acc028a65bae10462bd77e6af2b510b022c29df60a1d84eac4a9

Download Submit
memory/3136-140-0x0000000004A10000-0x0000000004FB4000-memory.dmp

Filesize
5.6MB

Download
memory/3136-141-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/3136-142-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3136-143-0x00000000051C0000-0x000000000525C000-memory.dmp

Filesize
624KB

Download
memory/3136-144-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Filesize
408KB

Download
memory/3136-145-0x0000000000900000-0x0000000000950000-memory.dmp

Filesize
320KB

Download
memory/3136-146-0x00000000059D0000-0x00000000059DA000-memory.dmp

Filesize
40KB

Download
memory/4784-136-0x0000000000530000-0x0000000000533000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing