agenttesla | 958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa

General

Target

958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
Size

896KB
MD5

772e33e3128cd815827b68962d35a707
SHA1

de800a3bc8498bd6dda93461d5119400c3517d6f
SHA256

958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa
SHA512

c6e2d9f85fc4d3b4891717daf15709ddf6f275b04126718c75fe2c13c03896d30bcdcb5e56c22a2adfacf5da46a7e9ae3fbb8b34d56d677c280dafb4d6849a30
SSDEEP

12288:3oqnHvjNIrpf9rN/mc/CUCwYcg+5kn4CQga5ZDnFdYJzadBL/JqI3eAe4Qvrpm86:3lPjKr5BNDlkn4oaDD/YJmF5Qz0bCK

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6491123377:AAHfZF2lTXFg1xxaNDsPtoz_ltH2gj_Gldk/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
6 ip-api.com

flow	ioc
4	api.ipify.org
5	api.ipify.org
6	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe

description	pid	process	target process
PID 2128 set thread context of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2756 schtasks.exe

pid	process
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exepowershell.exe

pid	process
2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
2556	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
2556	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
2696	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
Token: SeDebugPrivilege	2556	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
Token: SeDebugPrivilege	2696	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe

pid process

2556 958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe

pid	process
2556	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe

description	pid	process	target process
PID 2128 wrote to memory of 2696	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	powershell.exe
PID 2128 wrote to memory of 2696	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	powershell.exe
PID 2128 wrote to memory of 2696	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	powershell.exe
PID 2128 wrote to memory of 2696	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	powershell.exe
PID 2128 wrote to memory of 2756	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	schtasks.exe
PID 2128 wrote to memory of 2756	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	schtasks.exe
PID 2128 wrote to memory of 2756	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	schtasks.exe
PID 2128 wrote to memory of 2756	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	schtasks.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
PID 2128 wrote to memory of 2556	2128	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe	958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe

C:\Users\Admin\AppData\Local\Temp\958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
"C:\Users\Admin\AppData\Local\Temp\958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mJIIKKiJ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mJIIKKiJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp57FF.tmp"
2⤵
- Creates scheduled task(s)
PID:2756

C:\Users\Admin\AppData\Local\Temp\958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe
"C:\Users\Admin\AppData\Local\Temp\958be6e7fda577712166c295391da425c7dba2de6d16884bea36fdb72f44cdaa.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2556

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp57FF.tmp
Filesize
1KB

MD5
8c6c799b523a850ad0ff83e10edd4d17

SHA1
23fa49165b85d86786d7a07daec8c224156c4f79

SHA256
64bc0950ea4a074bf3c3fa965eb4582b48b4f6411e7f9a79d02a820acd2efaf0

SHA512
8e6694ee129cc8aa038cdeca535f22163656c1a795fc0a8d20862f18f073f7f4a65ef82591f105db5b455347d803ff616abacc93db77a73a71f4b9c41ddb4693

Download Submit
memory/2128-0-0x0000000000E40000-0x0000000000F26000-memory.dmp

Filesize
920KB

Download
memory/2128-1-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2128-2-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2128-3-0x0000000000650000-0x0000000000670000-memory.dmp

Filesize
128KB

Download
memory/2128-4-0x00000000004A0000-0x00000000004B4000-memory.dmp

Filesize
80KB

Download
memory/2128-5-0x0000000005010000-0x0000000005094000-memory.dmp

Filesize
528KB

Download
memory/2128-25-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2556-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2556-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2556-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2556-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2556-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2556-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2556-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2556-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads