agenttesla | 13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4

General

Target

proforma invoice.exe
Size

687KB
MD5

34e65ca275e94eb01fa9bff73b1a4f99
SHA1

243e7e34ada4e5993c836980e899664a85eaa14b
SHA256

13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4
SHA512

1021a5d4f04330b68a15c20427c510ae7c2960e70eb6b40050415bcb8e7f99576cd4264555c7ee879341c9451ea1eeeab56db3c157f73805a9585e1e5aaad9ed
SSDEEP

12288:ig0YOwq+phFjZyzFXvQnUpo0ddzpYIkNbKGQx6GqLBjLH1MtlWlmRvWzfwI:JO7e8F/7NjKIkNbKGwr6WtglWvWD

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.satsllc.ae
Port:
587
Username:
ahsan@satsllc.ae
Password:
Ahsan@12345
Email To:
benj50454@gmail.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

proforma invoice.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	proforma invoice.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

25 api.ipify.org
26 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

proforma invoice.exe

description pid process target process

PID 4364 set thread context of 4352 4364 proforma invoice.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4108 schtasks.exe

flow	ioc
25	api.ipify.org
26	api.ipify.org

description	pid	process	target process
PID 4364 set thread context of 4352	4364	proforma invoice.exe	RegSvcs.exe

pid	process
4108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

proforma invoice.exeRegSvcs.exepowershell.exe

pid	process
4364	proforma invoice.exe
4364	proforma invoice.exe
4364	proforma invoice.exe
4352	RegSvcs.exe
4352	RegSvcs.exe
4352	RegSvcs.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

proforma invoice.exepowershell.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 4364 proforma invoice.exe
Token: SeDebugPrivilege 3580 powershell.exe
Token: SeDebugPrivilege 4352 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4364	proforma invoice.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	4352	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

proforma invoice.exe

description	pid	process	target process
PID 4364 wrote to memory of 3580	4364	proforma invoice.exe	powershell.exe
PID 4364 wrote to memory of 3580	4364	proforma invoice.exe	powershell.exe
PID 4364 wrote to memory of 3580	4364	proforma invoice.exe	powershell.exe
PID 4364 wrote to memory of 4108	4364	proforma invoice.exe	schtasks.exe
PID 4364 wrote to memory of 4108	4364	proforma invoice.exe	schtasks.exe
PID 4364 wrote to memory of 4108	4364	proforma invoice.exe	schtasks.exe
PID 4364 wrote to memory of 4352	4364	proforma invoice.exe	RegSvcs.exe
PID 4364 wrote to memory of 4352	4364	proforma invoice.exe	RegSvcs.exe
PID 4364 wrote to memory of 4352	4364	proforma invoice.exe	RegSvcs.exe
PID 4364 wrote to memory of 4352	4364	proforma invoice.exe	RegSvcs.exe
PID 4364 wrote to memory of 4352	4364	proforma invoice.exe	RegSvcs.exe
PID 4364 wrote to memory of 4352	4364	proforma invoice.exe	RegSvcs.exe
PID 4364 wrote to memory of 4352	4364	proforma invoice.exe	RegSvcs.exe
PID 4364 wrote to memory of 4352	4364	proforma invoice.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe
"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zsHSBdyxHEzyp.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zsHSBdyxHEzyp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5C92.tmp"
2⤵
- Creates scheduled task(s)
PID:4108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4440

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnp4xb4c.ncw.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5C92.tmp
Filesize
1KB

MD5
8b9d72af997ba9ea0f85764556e389f2

SHA1
41d18efe6e07ac0cd2da5719798be705c9ebd917

SHA256
a48a1e82946460de0426070385f54bba2642ae89683c33b69043a802e327ec78

SHA512
83cfdd975463febe9cabc62615bcdec6920c8cbf2ee30ee80ac22e2153984b330e04a98966273f7838bc290376a4f6c685c1f4fcc9b714ebae1a5ef89d728365

Download Submit
memory/3580-15-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/3580-37-0x00000000061C0000-0x00000000061DE000-memory.dmp

Filesize
120KB

Download
memory/3580-55-0x00000000074E0000-0x00000000074FA000-memory.dmp

Filesize
104KB

Download
memory/3580-35-0x0000000005BE0000-0x0000000005F34000-memory.dmp

Filesize
3.3MB

Download
memory/3580-66-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/3580-63-0x0000000007800000-0x0000000007808000-memory.dmp

Filesize
32KB

Download
memory/3580-62-0x0000000007820000-0x000000000783A000-memory.dmp

Filesize
104KB

Download
memory/3580-61-0x0000000007720000-0x0000000007734000-memory.dmp

Filesize
80KB

Download
memory/3580-14-0x0000000004BC0000-0x0000000004BF6000-memory.dmp

Filesize
216KB

Download
memory/3580-60-0x0000000007710000-0x000000000771E000-memory.dmp

Filesize
56KB

Download
memory/3580-16-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3580-59-0x00000000076E0000-0x00000000076F1000-memory.dmp

Filesize
68KB

Download
memory/3580-18-0x0000000005270000-0x0000000005898000-memory.dmp

Filesize
6.2MB

Download
memory/3580-54-0x0000000007B20000-0x000000000819A000-memory.dmp

Filesize
6.5MB

Download
memory/3580-53-0x0000000007390000-0x0000000007433000-memory.dmp

Filesize
652KB

Download
memory/3580-56-0x0000000007550000-0x000000000755A000-memory.dmp

Filesize
40KB

Download
memory/3580-42-0x0000000070B60000-0x0000000070BAC000-memory.dmp

Filesize
304KB

Download
memory/3580-52-0x0000000006770000-0x000000000678E000-memory.dmp

Filesize
120KB

Download
memory/3580-25-0x00000000051D0000-0x00000000051F2000-memory.dmp

Filesize
136KB

Download
memory/3580-26-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Filesize
408KB

Download
memory/3580-41-0x0000000006790000-0x00000000067C2000-memory.dmp

Filesize
200KB

Download
memory/3580-57-0x0000000007760000-0x00000000077F6000-memory.dmp

Filesize
600KB

Download
memory/3580-40-0x000000007FAA0000-0x000000007FAB0000-memory.dmp

Filesize
64KB

Download
memory/3580-38-0x0000000006260000-0x00000000062AC000-memory.dmp

Filesize
304KB

Download
memory/3580-39-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/4352-23-0x00000000058D0000-0x00000000058E0000-memory.dmp

Filesize
64KB

Download
memory/4352-67-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/4352-22-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/4352-24-0x00000000058E0000-0x0000000005946000-memory.dmp

Filesize
408KB

Download
memory/4352-58-0x0000000006C80000-0x0000000006CD0000-memory.dmp

Filesize
320KB

Download
memory/4352-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4352-68-0x00000000058D0000-0x00000000058E0000-memory.dmp

Filesize
64KB

Download
memory/4364-2-0x0000000005ED0000-0x0000000006474000-memory.dmp

Filesize
5.6MB

Download
memory/4364-5-0x0000000005960000-0x000000000596A000-memory.dmp

Filesize
40KB

Download
memory/4364-21-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/4364-3-0x00000000059C0000-0x0000000005A52000-memory.dmp

Filesize
584KB

Download
memory/4364-0-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/4364-9-0x0000000009940000-0x00000000099DC000-memory.dmp

Filesize
624KB

Download
memory/4364-8-0x0000000007300000-0x0000000007382000-memory.dmp

Filesize
520KB

Download
memory/4364-7-0x0000000005EA0000-0x0000000005EAC000-memory.dmp

Filesize
48KB

Download
memory/4364-6-0x0000000006CD0000-0x0000000006CEA000-memory.dmp

Filesize
104KB

Download
memory/4364-1-0x0000000000EB0000-0x0000000000F62000-memory.dmp

Filesize
712KB

Download
memory/4364-4-0x0000000003550000-0x0000000003560000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads