agenttesla | ba4bb4f3c8ab492f91afef4b78fbb3a51a4e7d42ece2c7d8d36822cd83c85bde

General

Target

TH PG FORM E DRAFT FOR CEI2303125.pdf.exe
Size

988KB
MD5

06d1f96907c8265da37dfd9dcce3bff3
SHA1

df6e90bc4534b80433b045ba767d62d3f170ae6e
SHA256

1934c9d93e6a4198e68757441c611e6c31306b38aeec33a5f1f6c09f1f8ce466
SHA512

3b7562f2a03037ce2b4c3fdf5f5391ba8036697939d336f9b23a835d717297397f32e65815cfb55c949822012200cdd89a7ea95db6269488eb391b0911917aa8
SSDEEP

12288:OWoCRCrFF1HvV7J9BEMF/UTpUMCyrxLxoWMLI8N2RMXmPqpYyEiGen55bQ+k9iFs:BoCRC77J9tGtWINag

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.unitechautomations.com
Port:
587
Username:
[email protected]
Password:
Unitech@123
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlflvDv = "C:\\Users\\Admin\\AppData\\Roaming\\vlflvDv\\vlflvDv.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
66	api.ipify.org
68	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4028 set thread context of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe
4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe
4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe
4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe
3996	RegSvcs.exe
3996	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe
Token: SeDebugPrivilege	3996	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3228	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	94
PID 4028 wrote to memory of 3228	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	94
PID 4028 wrote to memory of 3228	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	94
PID 4028 wrote to memory of 908	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	97
PID 4028 wrote to memory of 908	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	97
PID 4028 wrote to memory of 908	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	97
PID 4028 wrote to memory of 4700	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	99
PID 4028 wrote to memory of 4700	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	99
PID 4028 wrote to memory of 4700	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	99
PID 4028 wrote to memory of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100
PID 4028 wrote to memory of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100
PID 4028 wrote to memory of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100
PID 4028 wrote to memory of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100
PID 4028 wrote to memory of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100
PID 4028 wrote to memory of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100
PID 4028 wrote to memory of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100
PID 4028 wrote to memory of 3996	4028	TH PG FORM E DRAFT FOR CEI2303125.pdf.exe	100

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\TH PG FORM E DRAFT FOR CEI2303125.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\TH PG FORM E DRAFT FOR CEI2303125.pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XPiLdxbVZo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5D5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:4700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF5D5.tmp

Filesize
1KB

MD5
65f1a34c55576f857779d7b8ba017f24

SHA1
7290ffda1d868354034100ddb03b6d8490e6675f

SHA256
621418cc82231936345388a5160ffda4aff4e66d571b5bb841987a961dfe989a

SHA512
e144572b20b831715d9f5be0301d74a15c7dff8cd4c0fac5b969db1d55139c235a4709051a5800d445ae6ec0857529e1c59be5dfabc11f6b37dd202615f58253

Download Submit
memory/3996-26-0x00000000069C0000-0x0000000006A10000-memory.dmp

Filesize
320KB

Download
memory/3996-24-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3996-23-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/3996-22-0x0000000005310000-0x0000000005376000-memory.dmp

Filesize
408KB

Download
memory/3996-21-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3996-20-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/3996-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4028-5-0x0000000008190000-0x00000000081A0000-memory.dmp

Filesize
64KB

Download
memory/4028-7-0x0000000008130000-0x0000000008186000-memory.dmp

Filesize
344KB

Download
memory/4028-10-0x0000000008190000-0x00000000081A0000-memory.dmp

Filesize
64KB

Download
memory/4028-11-0x00000000084D0000-0x00000000084DC000-memory.dmp

Filesize
48KB

Download
memory/4028-12-0x0000000009800000-0x0000000009880000-memory.dmp

Filesize
512KB

Download
memory/4028-13-0x0000000003200000-0x0000000003242000-memory.dmp

Filesize
264KB

Download
memory/4028-8-0x0000000008AA0000-0x0000000008DF4000-memory.dmp

Filesize
3.3MB

Download
memory/4028-9-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4028-19-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4028-6-0x00000000059F0000-0x00000000059FA000-memory.dmp

Filesize
40KB

Download
memory/4028-0-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4028-4-0x0000000007F40000-0x0000000007FD2000-memory.dmp

Filesize
584KB

Download
memory/4028-3-0x00000000084F0000-0x0000000008A94000-memory.dmp

Filesize
5.6MB

Download
memory/4028-2-0x0000000007EA0000-0x0000000007F3C000-memory.dmp

Filesize
624KB

Download
memory/4028-1-0x0000000000EC0000-0x0000000000FBC000-memory.dmp

Filesize
1008KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads