agenttesla | 13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4

General

Target

proforma invoice.exe
Size

687KB
MD5

34e65ca275e94eb01fa9bff73b1a4f99
SHA1

243e7e34ada4e5993c836980e899664a85eaa14b
SHA256

13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4
SHA512

1021a5d4f04330b68a15c20427c510ae7c2960e70eb6b40050415bcb8e7f99576cd4264555c7ee879341c9451ea1eeeab56db3c157f73805a9585e1e5aaad9ed
SSDEEP

12288:ig0YOwq+phFjZyzFXvQnUpo0ddzpYIkNbKGQx6GqLBjLH1MtlWlmRvWzfwI:JO7e8F/7NjKIkNbKGwr6WtglWvWD

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.satsllc.ae
Port:
587
Username:
ahsan@satsllc.ae
Password:
Ahsan@12345
Email To:
benj50454@gmail.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

proforma invoice.exe

description pid process target process

PID 2456 set thread context of 2548 2456 proforma invoice.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2500 schtasks.exe

flow	ioc
5	api.ipify.org
4	api.ipify.org

description	pid	process	target process
PID 2456 set thread context of 2548	2456	proforma invoice.exe	RegSvcs.exe

pid	process
2500	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

proforma invoice.exeRegSvcs.exepowershell.exe

pid	process
2456	proforma invoice.exe
2456	proforma invoice.exe
2456	proforma invoice.exe
2456	proforma invoice.exe
2548	RegSvcs.exe
2548	RegSvcs.exe
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

proforma invoice.exeRegSvcs.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2456 proforma invoice.exe
Token: SeDebugPrivilege 2548 RegSvcs.exe
Token: SeDebugPrivilege 2764 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2456	proforma invoice.exe
Token: SeDebugPrivilege	2548	RegSvcs.exe
Token: SeDebugPrivilege	2764	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

proforma invoice.exe

description	pid	process	target process
PID 2456 wrote to memory of 2764	2456	proforma invoice.exe	powershell.exe
PID 2456 wrote to memory of 2764	2456	proforma invoice.exe	powershell.exe
PID 2456 wrote to memory of 2764	2456	proforma invoice.exe	powershell.exe
PID 2456 wrote to memory of 2764	2456	proforma invoice.exe	powershell.exe
PID 2456 wrote to memory of 2500	2456	proforma invoice.exe	schtasks.exe
PID 2456 wrote to memory of 2500	2456	proforma invoice.exe	schtasks.exe
PID 2456 wrote to memory of 2500	2456	proforma invoice.exe	schtasks.exe
PID 2456 wrote to memory of 2500	2456	proforma invoice.exe	schtasks.exe
PID 2456 wrote to memory of 2640	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2640	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2640	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2640	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2640	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2640	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2640	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe
PID 2456 wrote to memory of 2548	2456	proforma invoice.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe
"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zsHSBdyxHEzyp.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zsHSBdyxHEzyp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC294.tmp"
2⤵
- Creates scheduled task(s)
PID:2500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:2640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC294.tmp
Filesize
1KB

MD5
791f2439bff17f00988ac0faeaf111fb

SHA1
bdd7ba102589e7f3b1bddc243dc5a01a0c132d6c

SHA256
bf66e314c4592af8c2af92888c0ed5b3fd8eec58143e939dc13e9a5217be9528

SHA512
332677d95b06f2914c2cd98822ef1095f8d3076c09c77377cf718f080d1f8678b82c31a9cafc359e6e420de9a14bcdd5cf6432bf232850cbd6cd590d79689707

Download Submit
memory/2456-0-0x0000000000390000-0x0000000000442000-memory.dmp

Filesize
712KB

Download
memory/2456-1-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2456-2-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

Filesize
256KB

Download
memory/2456-3-0x00000000004B0000-0x00000000004CA000-memory.dmp

Filesize
104KB

Download
memory/2456-4-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/2456-5-0x00000000054D0000-0x0000000005552000-memory.dmp

Filesize
520KB

Download
memory/2456-26-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-32-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2548-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-37-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/2548-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-36-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-31-0x0000000002650000-0x0000000002690000-memory.dmp

Filesize
256KB

Download
memory/2764-34-0x0000000002650000-0x0000000002690000-memory.dmp

Filesize
256KB

Download
memory/2764-33-0x0000000002650000-0x0000000002690000-memory.dmp

Filesize
256KB

Download
memory/2764-35-0x000000006EF50000-0x000000006F4FB000-memory.dmp

Filesize
5.7MB

Download
memory/2764-30-0x000000006EF50000-0x000000006F4FB000-memory.dmp

Filesize
5.7MB

Download
memory/2764-29-0x000000006EF50000-0x000000006F4FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads