Agent Tesla BEC Attack Delivers an In-Memory Infostealer

Summary

A Business Email Compromise (BEC) campaign is using a sophisticated JScript dropper to distribute Agent Tesla v4 malware. The attack relies on Unicode emoji obfuscation to evade signature-based detection and uses DonutLoader to execute a reflective payload directly in memory. Its primary objective is to steal credentials from web browsers, email clients, and Windows systems.

Investigation

Analysts reconstructed the attack chain beginning with a spoofed Metropolitan Bank and Trust Company email lure. The investigation uncovered a multi-stage execution flow involving JScript, DonutLoader shellcode, and an obfuscated .NET payload. Static analysis also revealed advanced anti-analysis techniques, including virtual machine detection and checks for sandbox-related DLLs.

Mitigation

Defenders should deploy behavioral AI for inbound email to identify deceptive phishing lures and provide context-aware warning banners. Hardening systems against fileless execution and monitoring communications over non-standard ports can further reduce risk. Rotating any credentials potentially exposed on an affected system is also essential following suspected compromise.

Response

If malicious activity is detected, organizations should isolate affected hosts immediately and treat any communication with identified C2 infrastructure as evidence of compromise. Browser passwords, email credentials, and Windows Vault entries should be rotated promptly. Forensic teams should also investigate for signs of in-memory injection and persistence through registry startup keys.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to deploy a malicious payload using a JScript dropper. To bypass simple filename-based detection, they utilize cscript.exe to execute a script. In this specific simulation, the attacker passes a command-line argument that contains the string ‘setup’ to mimic the known Agent Tesla deployment pattern, aiming to establish a foothold on the system through an automated script execution.

• Regression Test Script:

  # Simulation of a JScript dropper execution via cscript.exe 
  # using the 'setup' keyword to trigger the specific detection rule.
  
  $tempScript = "$env:TEMPmalicious_dropper.js"
  "WScript.Echo('Dropper Initialized');" | Out-File -FilePath $tempScript -Encoding ascii
  
  # This command is designed to trigger the rule: 
  # Image: cscript.exe AND CommandLine contains 'setup'
  Start-Process "cscript.exe" -ArgumentList "C:WindowsSystem32WindowsPowerShellv1.0powershell.exe setup.js" -Wait
  
  Write-Host "Simulation command executed. Check SIEM for Alert."

• Cleanup Commands:

  # Remove the simulated malicious script.
  Remove-Item -Path "$env:TEMPmalicious_dropper.js" -Force -ErrorAction SilentlyContinue