agenttesla | b8dbf3db5d56d847b13c3e517dd9e9e396038948ea1189e7f57c419f493c368c

General

Target

Remittance slip 060223.exe
Size

858KB
MD5

f572724244ebcdf8911c11e5b4a6ff29
SHA1

91ab9b959e3535e05e06d381646de113880947eb
SHA256

b8dbf3db5d56d847b13c3e517dd9e9e396038948ea1189e7f57c419f493c368c
SHA512

74fc1406fb2d5df6d07fcd02808b32afbd1d951406b5b39a5865c37d07b5262723f99173587961dfcb21835073a057d251a6f45a9f4c93f6b1d1bdcd16d248b3
SSDEEP

12288:0zSggsinDj1dM1o2kSYQHJbaCR+tTshb0kRSdA56SFceC+MCkQ3lo1XS+KhzbuT:0zsuiSYQ2shgk8dQ6wqC9qqI

Score

10^/10

agenttesla discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.starmech.net
Port:
587
Username:
[email protected]
Password:
nics123
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2304	powershell.exe
2704	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\BjTxJte = "C:\\Users\\Admin\\AppData\\Roaming\\BjTxJte\\BjTxJte.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 2200	2992	Remittance slip 060223.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remittance slip 060223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2992	Remittance slip 060223.exe
2304	powershell.exe
2992	Remittance slip 060223.exe
2992	Remittance slip 060223.exe
2704	powershell.exe
2992	Remittance slip 060223.exe
2992	Remittance slip 060223.exe
2992	Remittance slip 060223.exe
2992	Remittance slip 060223.exe
2200	RegSvcs.exe
2200	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	Remittance slip 060223.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2200	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2304	2992	Remittance slip 060223.exe	31
PID 2992 wrote to memory of 2304	2992	Remittance slip 060223.exe	31
PID 2992 wrote to memory of 2304	2992	Remittance slip 060223.exe	31
PID 2992 wrote to memory of 2304	2992	Remittance slip 060223.exe	31
PID 2992 wrote to memory of 2704	2992	Remittance slip 060223.exe	33
PID 2992 wrote to memory of 2704	2992	Remittance slip 060223.exe	33
PID 2992 wrote to memory of 2704	2992	Remittance slip 060223.exe	33
PID 2992 wrote to memory of 2704	2992	Remittance slip 060223.exe	33
PID 2992 wrote to memory of 2904	2992	Remittance slip 060223.exe	35
PID 2992 wrote to memory of 2904	2992	Remittance slip 060223.exe	35
PID 2992 wrote to memory of 2904	2992	Remittance slip 060223.exe	35
PID 2992 wrote to memory of 2904	2992	Remittance slip 060223.exe	35
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37
PID 2992 wrote to memory of 2200	2992	Remittance slip 060223.exe	37

C:\Users\Admin\AppData\Local\Temp\Remittance slip 060223.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance slip 060223.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Remittance slip 060223.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pZgcCZTJDPiQe.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pZgcCZTJDPiQe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F82.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1F82.tmp

Filesize
1KB

MD5
5fc8fdb735209b1b62f70094e2034a38

SHA1
23b829f388aa9ad121d2cc189fb1d1b9a50ea6e5

SHA256
355d50f8782c8c730fac629cce98f6c847e07a7feff18748df848518bfd009d6

SHA512
18218dbe69362803fd6efa62761a131ed3642c26fb6b56f58eb59f54f1ff0eb02dee87f8e9025a7866240e671678bba5d408bb8f4191a78965e81cb781e285a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
7181e5e6fadc1ba99c9e39077ff7d298

SHA1
4de1286700ca3cbc9069576b62dc82f239a869b0

SHA256
8010814cdfa494b1fe8f0ee561080041309f753e623f9432d738525e88ceec02

SHA512
51f5304bc84cf3a9c9d4b3e07ed56b485c8324200451d0aaceb711592d6dfaeb941eb4729a3c433f9f6117f6ffd8faa5dfa736983e0b02cee222f732a0721b5a

Download Submit
memory/2200-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2200-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2200-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2200-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2200-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2200-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2200-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2200-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-6-0x0000000000420000-0x00000000004A6000-memory.dmp

Filesize
536KB

Download
memory/2992-1-0x00000000013A0000-0x000000000147C000-memory.dmp

Filesize
880KB

Download
memory/2992-0-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/2992-2-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2992-3-0x0000000000240000-0x000000000025E000-memory.dmp

Filesize
120KB

Download
memory/2992-5-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2992-4-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/2992-32-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads