agenttesla | 1cc3f2ee6a83832c378f4369c71aae81616ebf016af234e6c71e59fa5e807ec2

General

Target

final SEAWAY BILL pdf.exe
Size

908KB
MD5

c1b8b4e30ea64942210e7708131fcb6b
SHA1

e9c5e2c762225ff260711276313b37b8ca5e491b
SHA256

1cc3f2ee6a83832c378f4369c71aae81616ebf016af234e6c71e59fa5e807ec2
SHA512

6bca34084961117d64be62deb809c6b6aa1273ec7986a2b659434af02b5472cfd01725c30d227b09bb02004762978e63542af3ebc5ffbf042aaeecd2e43e70e6
SSDEEP

24576:qwlG1wF9EwXcPd4D4kFFp9FyjQ1W5d+gXd/qwvagNd/xFPoFuywVdDwCbJKATsI2:qwlG1wF9EwXcPd4D4kFFp9FyjQ1W5d+X

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\yGbzOMp = "C:\\Users\\Admin\\AppData\\Roaming\\yGbzOMp\\yGbzOMp.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

final SEAWAY BILL pdf.exe

description pid process target process

PID 1316 set thread context of 584 1316 final SEAWAY BILL pdf.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

472 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

final SEAWAY BILL pdf.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1316 final SEAWAY BILL pdf.exe
Token: SeDebugPrivilege 584 RegSvcs.exe

description	pid	process	target process
PID 1316 set thread context of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe

pid	process
472	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1316	final SEAWAY BILL pdf.exe
Token: SeDebugPrivilege	584	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

final SEAWAY BILL pdf.exe

description	pid	process	target process
PID 1316 wrote to memory of 472	1316	final SEAWAY BILL pdf.exe	schtasks.exe
PID 1316 wrote to memory of 472	1316	final SEAWAY BILL pdf.exe	schtasks.exe
PID 1316 wrote to memory of 472	1316	final SEAWAY BILL pdf.exe	schtasks.exe
PID 1316 wrote to memory of 472	1316	final SEAWAY BILL pdf.exe	schtasks.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 1316 wrote to memory of 584	1316	final SEAWAY BILL pdf.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\final SEAWAY BILL pdf.exe
"C:\Users\Admin\AppData\Local\Temp\final SEAWAY BILL pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uSxvrqC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp760B.tmp"
2⤵
- Creates scheduled task(s)
PID:472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:584

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp760B.tmp
Filesize
1KB

MD5
501ca7c0d4d8ff6b232836db4c1b0249

SHA1
b8a69d344350c396cbe71dc0cac75c6dd5ec1c15

SHA256
151d1e6cc1119195dd80006a525ab86a8d3216ee84019672e422afad077adaf3

SHA512
f628dc6888a9a927baa517daf27eb71e895b62af04e88bbb510a181e2123d65fc20b79767c5e9846b52dc8bda29f76814dc584a17e162518e33eade8cff13156

Download Submit
memory/584-68-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/584-63-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/584-75-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download
memory/584-73-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download
memory/584-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/584-72-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/584-70-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/584-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/584-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/584-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1316-59-0x0000000000A30000-0x0000000000A60000-memory.dmp

Filesize
192KB

Download
memory/1316-54-0x0000000001150000-0x000000000123A000-memory.dmp

Filesize
936KB

Download
memory/1316-56-0x00000000004A0000-0x00000000004AE000-memory.dmp

Filesize
56KB

Download
memory/1316-55-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/1316-58-0x0000000004E00000-0x0000000004E7C000-memory.dmp

Filesize
496KB

Download
memory/1316-57-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads