agenttesla | bbbd6d62c9a751f4ce43c884d0c91f5a40bc78e381d56a5e10a99d278154dd80

General

Target

Shipping Docments.exe
Size

479KB
MD5

4d2bc1656cfe1547a4ab4f0433dea8be
SHA1

4f6bae02ef8c5da844da756ddb457b79e640d069
SHA256

bbbd6d62c9a751f4ce43c884d0c91f5a40bc78e381d56a5e10a99d278154dd80
SHA512

d55a487122d069606bbd5cf32a17202a856e75a12941e648144eddab3a26c8aefefaf1197d1684109fb4ed272cfb80ec847c2db2dc07994a295ad781c3725c2b

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.saharanepal.coop.np
Port:
587
Username:
sijuwa@saharanepal.coop.np
Password:
sijuwa@sahara

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.saharanepal.coop.np
Port:
587
Username:
sijuwa@saharanepal.coop.np
Password:
sijuwa@sahara

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3496-2-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral2/memory/3496-3-0x000000000044A6BE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Shipping Docments.exe

description pid process target process

PID 3592 set thread context of 3496 3592 Shipping Docments.exe Shipping Docments.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2596 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Shipping Docments.exe

pid process

3496 Shipping Docments.exe
3496 Shipping Docments.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Shipping Docments.exe

description pid process

Token: SeDebugPrivilege 3496 Shipping Docments.exe

description	pid	process	target process
PID 3592 set thread context of 3496	3592	Shipping Docments.exe	Shipping Docments.exe

pid	process
2596	schtasks.exe

pid	process
3496	Shipping Docments.exe
3496	Shipping Docments.exe

description	pid	process
Token: SeDebugPrivilege	3496	Shipping Docments.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Shipping Docments.exe

description	pid	process	target process
PID 3592 wrote to memory of 2596	3592	Shipping Docments.exe	schtasks.exe
PID 3592 wrote to memory of 2596	3592	Shipping Docments.exe	schtasks.exe
PID 3592 wrote to memory of 2596	3592	Shipping Docments.exe	schtasks.exe
PID 3592 wrote to memory of 3496	3592	Shipping Docments.exe	Shipping Docments.exe
PID 3592 wrote to memory of 3496	3592	Shipping Docments.exe	Shipping Docments.exe
PID 3592 wrote to memory of 3496	3592	Shipping Docments.exe	Shipping Docments.exe
PID 3592 wrote to memory of 3496	3592	Shipping Docments.exe	Shipping Docments.exe
PID 3592 wrote to memory of 3496	3592	Shipping Docments.exe	Shipping Docments.exe
PID 3592 wrote to memory of 3496	3592	Shipping Docments.exe	Shipping Docments.exe
PID 3592 wrote to memory of 3496	3592	Shipping Docments.exe	Shipping Docments.exe
PID 3592 wrote to memory of 3496	3592	Shipping Docments.exe	Shipping Docments.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Docments.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Docments.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\abCQyorJbUCtI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2485.tmp"
2⤵
- Creates scheduled task(s)
PID:2596

C:\Users\Admin\AppData\Local\Temp\Shipping Docments.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Shipping Docments.exe.log
MD5
e5ada129ae553b760891d0d6ba3dbc88

SHA1
cc80f0f1a950eaf22f51d25eab57f0fc15636744

SHA256
665987eb14260f3f169d78022638a2efd7ba4f2a4749a84f90801d8ec259842c

SHA512
f36864fbb7d9b074fa9cd25ca16bbd137f0b78735bdb24062924e2675b1b1e89a98b0f5f7fa2aee4f3e72932464af4a2933b767b947b39a4ef9e2e1e66824a11

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2485.tmp
MD5
6cb3f87811908ed6b3d62e1323525666

SHA1
43cc0b30a77d1e1431f0680ebe6330f5f7a895ba

SHA256
5c71105c7c9bdd4db2377a5bc37efad0bb48d02f691e0c6b7d6dea8918319b34

SHA512
920013aa74d977dc2a7a1a0c34fadd5b518f5aaad60ec4ffd420a6ca9b12456897a4507906166c518bb26f99bb423c1d55138c7e5d20b8d209b1696017af2419

Download Submit
memory/2596-0-0x0000000000000000-mapping.dmp

Download
memory/3496-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3496-3-0x000000000044A6BE-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads