agenttesla | d1597a1081547fc01a3cac3d22c31b5cd21ae2ad3b95c4b2a0fa75e9e77d204a

General

Target

Shipping documentsInvoice and Packing List.exe
Size

1.1MB
MD5

a78784673b95a0368e80d0f56481b2c9
SHA1

d6c57ae123c5b98fa5e74c705ab2f0ebef60d859
SHA256

d1597a1081547fc01a3cac3d22c31b5cd21ae2ad3b95c4b2a0fa75e9e77d204a
SHA512

98df4367be9a9027062373e6f999971cf5d47c65be0348e0caf8fcceacd69702ac59bff7e61c55ed082edeafb929b7671022c8444618dc8ae6dc9613ae11cc23
SSDEEP

24576:S4lavt0LkLL9IMixoEgea55qGbjauDaq9MmCS:Fkwkn9IMHea5L61aPCS

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7183646529:AAFkQSKmdVoaYTv19prcb1lxCwzZZaLys8o/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Drops startup file 1 IoCs

Processes:

name.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe
Executes dropped EXE 1 IoCs

Processes:

name.exe

pid process

1836 name.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

pid	process
1836	name.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\My App = "C:\\Users\\Admin\\AppData\\Roaming\\My App\\My App.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

63 api.ipify.org
64 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

name.exe

description pid process target process

PID 1836 set thread context of 1032 1836 name.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1032 RegSvcs.exe
1032 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

name.exe

pid process

1836 name.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1032 RegSvcs.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Shipping documentsInvoice and Packing List.exename.exe

pid process

884 Shipping documentsInvoice and Packing List.exe
884 Shipping documentsInvoice and Packing List.exe
1836 name.exe
1836 name.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Shipping documentsInvoice and Packing List.exename.exe

pid process

884 Shipping documentsInvoice and Packing List.exe
884 Shipping documentsInvoice and Packing List.exe
1836 name.exe
1836 name.exe

flow	ioc
63	api.ipify.org
64	api.ipify.org

description	pid	process	target process
PID 1836 set thread context of 1032	1836	name.exe	RegSvcs.exe

pid	process
1032	RegSvcs.exe
1032	RegSvcs.exe

pid	process
1836	name.exe

description	pid	process
Token: SeDebugPrivilege	1032	RegSvcs.exe

pid	process
884	Shipping documentsInvoice and Packing List.exe
884	Shipping documentsInvoice and Packing List.exe
1836	name.exe
1836	name.exe

pid	process
884	Shipping documentsInvoice and Packing List.exe
884	Shipping documentsInvoice and Packing List.exe
1836	name.exe
1836	name.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Shipping documentsInvoice and Packing List.exename.exe

description	pid	process	target process
PID 884 wrote to memory of 1836	884	Shipping documentsInvoice and Packing List.exe	name.exe
PID 884 wrote to memory of 1836	884	Shipping documentsInvoice and Packing List.exe	name.exe
PID 884 wrote to memory of 1836	884	Shipping documentsInvoice and Packing List.exe	name.exe
PID 1836 wrote to memory of 1032	1836	name.exe	RegSvcs.exe
PID 1836 wrote to memory of 1032	1836	name.exe	RegSvcs.exe
PID 1836 wrote to memory of 1032	1836	name.exe	RegSvcs.exe
PID 1836 wrote to memory of 1032	1836	name.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884

C:\Users\Admin\AppData\Local\directory\name.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping documentsInvoice and Packing List.exe"
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut4769.tmp
Filesize
262KB

MD5
b3e8ad5bb2d6f05dba9e38094cc44f05

SHA1
dc508fa1070fbc537dfc32bda0cddce6a4e9b540

SHA256
bc96a7c9983b56f1e036fd2e88e488851048930436d8f08b4a1ae920ef6254ef

SHA512
f638c1654cf91634cc5e41242d6c4d1b3f26a53dbfb47644920afab055579bfe03663eb9d83a42ef93817ffbfcc6ad315ca3134f992b9af9e63153681bc79b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\deblateration
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/884-12-0x00000000047D0000-0x00000000047D4000-memory.dmp

Filesize
16KB

Download
memory/1032-32-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1032-34-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1032-33-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1032-35-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1032-36-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/1032-37-0x00000000032C0000-0x0000000003314000-memory.dmp

Filesize
336KB

Download
memory/1032-39-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/1032-38-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1032-41-0x0000000005800000-0x0000000005852000-memory.dmp

Filesize
328KB

Download
memory/1032-42-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1032-40-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1032-54-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-102-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-98-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-96-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-94-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-92-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-90-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-88-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-86-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-84-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-82-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-78-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-76-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-74-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-72-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-70-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-68-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-67-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-64-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-62-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-60-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-58-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-56-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-52-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-50-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-48-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-46-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-44-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-43-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-100-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-80-0x0000000005800000-0x000000000584D000-memory.dmp

Filesize
308KB

Download
memory/1032-1077-0x0000000005A30000-0x0000000005A96000-memory.dmp

Filesize
408KB

Download
memory/1032-1078-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1032-1080-0x0000000006D30000-0x0000000006D80000-memory.dmp

Filesize
320KB

Download
memory/1032-1081-0x0000000006E60000-0x0000000006EF2000-memory.dmp

Filesize
584KB

Download
memory/1032-1082-0x0000000006E10000-0x0000000006E1A000-memory.dmp

Filesize
40KB

Download
memory/1032-1083-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/1032-1084-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads