agenttesla | b394bc4f98160161eb89ef8840f21c86ded8b96bc5994bfb75e5087852530267

General

Target

Statement of Account.exe
Size

565KB
MD5

e45e292ee1302005225b8ee245018cc8
SHA1

5dd2b9ee3d84b40e7d4aecc5cc068367729e88ea
SHA256

a212cb057ef247f50d13b60031f5ef2527f1d86c79628a7d3d8bc328cbe1ccf6
SHA512

a3d6cc6975682344ba35345a19df338ef753055ab3be22f6687c7a090846d980af98dcee76741134ddb82e09b2c48df9d11d1e66bfee6e10d710c146e679621b
SSDEEP

12288:h2AQaueH5q8IDUKiAhTM1cJ3lfi5EIKqi+6u4UXrcbyyEAo:h2EqxDXhTM+xlLIpiM4UQ9E

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.adityagroup.co
Port:
587
Username:
[email protected]
Password:
Aditya!@#$%^
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Statement of Account.exe

description pid process target process

PID 2352 set thread context of 2484 2352 Statement of Account.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2596 schtasks.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 2352 set thread context of 2484	2352	Statement of Account.exe	RegSvcs.exe

pid	process
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Statement of Account.exepowershell.exepowershell.exeRegSvcs.exe

pid	process
2352	Statement of Account.exe
2352	Statement of Account.exe
2352	Statement of Account.exe
2540	powershell.exe
1704	powershell.exe
2352	Statement of Account.exe
2484	RegSvcs.exe
2484	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Statement of Account.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2352	Statement of Account.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2484	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Statement of Account.exe

description	pid	process	target process
PID 2352 wrote to memory of 1704	2352	Statement of Account.exe	powershell.exe
PID 2352 wrote to memory of 1704	2352	Statement of Account.exe	powershell.exe
PID 2352 wrote to memory of 1704	2352	Statement of Account.exe	powershell.exe
PID 2352 wrote to memory of 1704	2352	Statement of Account.exe	powershell.exe
PID 2352 wrote to memory of 2540	2352	Statement of Account.exe	powershell.exe
PID 2352 wrote to memory of 2540	2352	Statement of Account.exe	powershell.exe
PID 2352 wrote to memory of 2540	2352	Statement of Account.exe	powershell.exe
PID 2352 wrote to memory of 2540	2352	Statement of Account.exe	powershell.exe
PID 2352 wrote to memory of 2596	2352	Statement of Account.exe	schtasks.exe
PID 2352 wrote to memory of 2596	2352	Statement of Account.exe	schtasks.exe
PID 2352 wrote to memory of 2596	2352	Statement of Account.exe	schtasks.exe
PID 2352 wrote to memory of 2596	2352	Statement of Account.exe	schtasks.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe
PID 2352 wrote to memory of 2484	2352	Statement of Account.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe
"C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UZZTTFhFFwXETf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UZZTTFhFFwXETf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50A0.tmp"
2⤵
- Creates scheduled task(s)
PID:2596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp50A0.tmp

Filesize
1KB

MD5
10c0f187b841f21a0c7da89de3bb6b71

SHA1
d662a8dd73aaeaf124706509690878e561960133

SHA256
9993f487a6ae19df367ffbe92ab481d5436fe66444784800f647315fe00d1632

SHA512
4758e6f82c2f0a4f8badde9e344b63e7a97bc01dc5a9fd4f9a1ba1b2ebd80ea59aedd155e9f8b2a6e3b51e7d00cd773426e41e02526c283cdffc68e9f501d91c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6AUPGWLK6IUETBJVQH9B.temp

Filesize
7KB

MD5
5131a8476d453cc02a9faf8c672ccc6d

SHA1
129e48bad7823b5a93c5d88a853bb4ed8d949cb0

SHA256
a92040e6ba948c3f47f533ceca6ab6ca5d98d4c446837cd698987132a19525a6

SHA512
b10f37860965693a7bacbf51caa1b452e70012494d4e8289ef6312c2513328dd24aa8128b6eedb6612f33f16cd26c6a58b1ddda3a289c43a9e710b4f0d6c260a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
5131a8476d453cc02a9faf8c672ccc6d

SHA1
129e48bad7823b5a93c5d88a853bb4ed8d949cb0

SHA256
a92040e6ba948c3f47f533ceca6ab6ca5d98d4c446837cd698987132a19525a6

SHA512
b10f37860965693a7bacbf51caa1b452e70012494d4e8289ef6312c2513328dd24aa8128b6eedb6612f33f16cd26c6a58b1ddda3a289c43a9e710b4f0d6c260a

Download Submit
memory/1704-23-0x000000006EF30000-0x000000006F4DB000-memory.dmp

Filesize
5.7MB

Download
memory/1704-49-0x000000006EF30000-0x000000006F4DB000-memory.dmp

Filesize
5.7MB

Download
memory/1704-41-0x000000006EF30000-0x000000006F4DB000-memory.dmp

Filesize
5.7MB

Download
memory/1704-36-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/1704-26-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/1704-32-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/2352-19-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-5-0x0000000000690000-0x000000000069A000-memory.dmp

Filesize
40KB

Download
memory/2352-1-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-2-0x0000000004C20000-0x0000000004C60000-memory.dmp

Filesize
256KB

Download
memory/2352-45-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-3-0x00000000006E0000-0x00000000006FA000-memory.dmp

Filesize
104KB

Download
memory/2352-0-0x0000000000360000-0x00000000003F2000-memory.dmp

Filesize
584KB

Download
memory/2352-6-0x0000000004B50000-0x0000000004BBA000-memory.dmp

Filesize
424KB

Download
memory/2352-43-0x0000000004C20000-0x0000000004C60000-memory.dmp

Filesize
256KB

Download
memory/2352-4-0x0000000000670000-0x0000000000678000-memory.dmp

Filesize
32KB

Download
memory/2484-46-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-22-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2484-50-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-20-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2484-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2484-44-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2484-40-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2484-37-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2484-29-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2484-47-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2484-24-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2540-28-0x0000000002D40000-0x0000000002D80000-memory.dmp

Filesize
256KB

Download
memory/2540-25-0x000000006EF30000-0x000000006F4DB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-31-0x000000006EF30000-0x000000006F4DB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-34-0x0000000002D40000-0x0000000002D80000-memory.dmp

Filesize
256KB

Download
memory/2540-48-0x000000006EF30000-0x000000006F4DB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-38-0x0000000002D40000-0x0000000002D80000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads