Analysis Details Agent Tesla Campaign Using Process Hollowing to Steal Credentials
Summary
Fortinet's analysis traces an Agent Tesla campaign from spearphishing and a JScript loader through encrypted PowerShell, reflective .NET loading and process hollowing, then virtualization checks and theft of browser cookies and credentials.
Key points
- The campaign starts with a business-themed spearphishing email carrying a RAR attachment with a JScript (.jse) loader.
- The loader downloads an encrypted PowerShell stage from catbox[.]moe.
- The PowerShell stage drops Base64-encoded .NET assemblies and uses reflective loading and process hollowing against Aspnet_compiler.exe.
- The malware queries WMI for VMware, VirtualBox and Hyper-V indicators, and may stop if it detects a virtualized environment.
- The analysis says Agent Tesla harvests browser cookies and credentials from local stores; SMTP is indicated as an exfiltration method.
- The article lists file hashes, the stage download URL and a mail server as indicators, and describes Fortinet products as defenses against several stages.
Article Details
- Attack Vectors
- A business-themed spearphishing email, with a RAR attachment containing a JScript (.jse) loader, initiates the infection.
- The loader downloads an encrypted PowerShell stage from catbox[.]moe.
- The PowerShell stage reflectively loads Base64-encoded .NET assemblies and uses process hollowing against Aspnet_compiler.exe.
- Agent Tesla probes for virtualization indicators through WMI and may stop if it detects a sandbox or virtualized environment.
- The malware harvests browser cookies and credentials from local stores and can exfiltrate stolen data over SMTP.
- Defensive Notes
- The article says FortiMail can detect and block phishing emails and strip malicious RAR/JSE attachments; FortiSandbox-based anti-phishing protection is also described.
- The article says FortiEDR detects and stops process hollowing and memory-based attacks, while FortiGate can block malicious downloads.
- The article describes FortiGuard CDR on FortiGate and FortiMail as removing active code from documents while preserving usability.
- The article says FortiGuard IP Reputation and Anti-Botnet Security Service can block infrastructure associated with the campaign.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mail[.]taikei-rmc-co[.]biz | Mail/C2 server identified as campaign infrastructure. |
| SHA256 | 30713c4bfc813848b3ec28eb227d2e439be0e07c77237498553fd5dfa745f278 | SHA-256 hash identified for the stage 2 PowerShell script. |
| SHA256 | 83f9c6a3978d926f2c0155e22008c1bce6510b321031598509a2937add2d5a54 | SHA-256 hash identified for the first encrypted PowerShell stage. |
| SHA256 | b133d75de5010c3a5005606a8e682a08c413364a3921dfbdfbfdde811a866e88 | SHA-256 hash identified for the Agent Tesla payload. |
| SHA256 | cc2b26bbcbaa2d0593e15a45734fe3fd940451fc7290d49bc841c496b906a9c1 | SHA-256 hash identified for the PO0172.jse loader. |
| URL | hxxps[:]//files[.]catbox[.]moe/2x0j75[.]ps1 | Download URL identified for the campaign's encrypted PowerShell stage. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects sensitive information from the infected host.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe article reports SMTP as a channel for exfiltrating stolen data.T1055.012 · Process HollowingThe malware starts Aspnet_compiler.exe suspended, hollows its memory, and replaces it with malicious code.T1059.001 · PowerShellDownloaded PowerShell scripts execute the campaign's in-memory stages.T1059.007 · JavaScriptA JScript (.jse) loader fetches the next payload stage.T1497.001 · System ChecksThe malware queries WMI for VMware, VirtualBox, and Hyper-V indicators and may stop when it detects a virtualized or sandbox environment.T1539 · Steal Web Session CookieAgent Tesla harvests browser cookies, including hostnames, expiry dates, and security flags.T1555.003 · Credentials from Web BrowsersThe campaign harvests credentials from local stores.T1566.001 · Spearphishing AttachmentThe campaign begins with a deceptive business-themed email carrying a RAR attachment with the JScript loader.T1620 · Reflective Code LoadingThe PowerShell stage reflectively loads Base64-encoded .NET assemblies in memory.
Malware
Vendors
Products
FortiEDRFortinet protections (FortiMail, FortiEDR, FortiGate, FortiGuard services) are noted as capable of blocking various stages including phishing, memory-based attacks, malicious downloads, and malicious attachments.FortiGuard CDRThe FortiGuard CDR (Content Disarm and Reconstruction) service, available on both FortiGate and FortiMail, can neutralize malicious content embedded in documents by removing active code while preserving documentFortiGuard IP Reputation and Anti-Botnet Security ServiceThe FortiGuard IP Reputation and Anti-Botnet Security Service proactively blocks infrastructure associated with this campaign by correlating malicious IP intelligence collected from Fortinet’s global sensor network,FortiMailFortinet protections (FortiMail, FortiEDR, FortiGate, FortiGuard services) are noted as capable of blocking various stages including phishing, memory-based attacks, malicious downloads, and malicious attachments.Fortinet FortiGateFortinet protections (FortiMail, FortiEDR, FortiGate, FortiGuard services) are noted as capable of blocking various stages including phishing, memory-based attacks, malicious downloads, and malicious attachments.FortiPhish Phishing Simulation ServiceThe FortiPhish phishing simulation service further supports user resilience by actively training and testing end users against real-world phishing techniques, including impersonation, Business Email Compromise (BEC),FortiSandboxIn addition, real-time anti-phishing protection provided by FortiSandbox, embedded across Fortinet’s FortiMail, web filtering, and antivirus solutions, enables advanced detection of both known and unknown phishingMicrosoft WindowsAffected Platforms: Microsoft Windows