agenttesla | c992f916c0381e40b3849ad77534f0bb944e4e42283793fd7ac06e245cd43cef

General

Target

Ach_Payment_Advice01.exe
Size

689KB
MD5

eeb0a5f2f2e765bbe937e595ddd0650a
SHA1

2a5127e5fdf921547b4ec39e964682469573e1f6
SHA256

2869686380724afd713bbefc58c9aceabd90692e27d9de7af96e748b3066d8e9
SHA512

46f36ddb5d6dc37ac4d1d0388c87971933e8f8fae7de89d54483b5a900365c786b859b9b7fbd7f721a03ac03025ce800f5ee3ebcb67aa22442d8df1853456ee8
SSDEEP

12288:c5h2Xp96Wtlc5ingN/JuXdH7O18x3UObHgf5jFuq4XQM5taSw40fgYYMiwp68kxU:c5UXfvtlc5yC/adbChYjl9c40oRwI81

Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7116470912:AAFcUeHH1656vYbBtccMjQVal4iMak99ZmA/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Ach_Payment_Advice01.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ach_Payment_Advice01.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Ach_Payment_Advice01.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Ach_Payment_Advice01.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2548 powershell.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Ach_Payment_Advice01.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools Ach_Payment_Advice01.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Ach_Payment_Advice01.exe

pid	process
2548	powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Ach_Payment_Advice01.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Ach_Payment_Advice01.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ach_Payment_Advice01.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ach_Payment_Advice01.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Ach_Payment_Advice01.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ach_Payment_Advice01.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ach_Payment_Advice01.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org

flow	ioc
4	api.ipify.org
5	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Ach_Payment_Advice01.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Ach_Payment_Advice01.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Ach_Payment_Advice01.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Ach_Payment_Advice01.exe

description pid process target process

PID 2932 set thread context of 2712 2932 Ach_Payment_Advice01.exe CasPol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeCasPol.exe

pid process

2548 powershell.exe
2712 CasPol.exe
2712 CasPol.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeCasPol.exe

description pid process

Token: SeDebugPrivilege 2548 powershell.exe
Token: SeDebugPrivilege 2712 CasPol.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

CasPol.exe

pid process

2712 CasPol.exe

description	pid	process	target process
PID 2932 set thread context of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe

pid	process
2548	powershell.exe
2712	CasPol.exe
2712	CasPol.exe

description	pid	process
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2712	CasPol.exe

pid	process
2712	CasPol.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Ach_Payment_Advice01.exe

description	pid	process	target process
PID 2932 wrote to memory of 2548	2932	Ach_Payment_Advice01.exe	powershell.exe
PID 2932 wrote to memory of 2548	2932	Ach_Payment_Advice01.exe	powershell.exe
PID 2932 wrote to memory of 2548	2932	Ach_Payment_Advice01.exe	powershell.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2712	2932	Ach_Payment_Advice01.exe	CasPol.exe
PID 2932 wrote to memory of 2568	2932	Ach_Payment_Advice01.exe	WerFault.exe
PID 2932 wrote to memory of 2568	2932	Ach_Payment_Advice01.exe	WerFault.exe
PID 2932 wrote to memory of 2568	2932	Ach_Payment_Advice01.exe	WerFault.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

Ach_Payment_Advice01.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ach_Payment_Advice01.exe

C:\Users\Admin\AppData\Local\Temp\Ach_Payment_Advice01.exe
"C:\Users\Admin\AppData\Local\Temp\Ach_Payment_Advice01.exe"
1⤵
- UAC bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ach_Payment_Advice01.exe" -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2712

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2932 -s 680
2⤵
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

1

T1562.001

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

4

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-23-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2548-24-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2712-9-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2712-16-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2712-11-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2712-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2712-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2712-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2712-18-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2712-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2932-4-0x00000000006B0000-0x0000000000746000-memory.dmp

Filesize
600KB

Download
memory/2932-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

Filesize
4KB

Download
memory/2932-2-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2932-1-0x00000000011B0000-0x00000000011CE000-memory.dmp

Filesize
120KB

Download
memory/2932-25-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

Filesize
4KB

Download
memory/2932-26-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads