agenttesla | 7d3068aff051388b3332905ca9a26a10a1cd96441e3be9d908cd839088cc9d65

General

Target

The details for your perusal.exe
Size

558KB
MD5

35f7b91f31292e3c9a4d187e9a4bd4b6
SHA1

00cf753c6fc011df51acf181cb6e79dc31f35171
SHA256

7d3068aff051388b3332905ca9a26a10a1cd96441e3be9d908cd839088cc9d65
SHA512

0b03a1f9efeb651a4f527d66d84572bad7fbb9a4379169910a2674fe54a2d1b19a36dc34cb54d71aa0c8a09b44035f6dd917041f17353e1d81dc31e62bc37bd9

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.emailsrvr.com
Port:
587
Username:
[email protected]
Password:
31081985@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1664-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1664-5-0x0000000000446BDE-mapping.dmp	family_agenttesla
behavioral1/memory/1664-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1664-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

The details for your perusal.exe

description pid process target process

PID 896 set thread context of 1664 896 The details for your perusal.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1052 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1664 RegSvcs.exe
1664 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1664 RegSvcs.exe

description	pid	process	target process
PID 896 set thread context of 1664	896	The details for your perusal.exe	RegSvcs.exe

pid	process
1052	schtasks.exe

pid	process
1664	RegSvcs.exe
1664	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1664	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

The details for your perusal.exe

description	pid	process	target process
PID 896 wrote to memory of 1052	896	The details for your perusal.exe	schtasks.exe
PID 896 wrote to memory of 1052	896	The details for your perusal.exe	schtasks.exe
PID 896 wrote to memory of 1052	896	The details for your perusal.exe	schtasks.exe
PID 896 wrote to memory of 1052	896	The details for your perusal.exe	schtasks.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe
PID 896 wrote to memory of 1664	896	The details for your perusal.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\The details for your perusal.exe
"C:\Users\Admin\AppData\Local\Temp\The details for your perusal.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YwOAaYLhO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB00C.tmp"
2⤵
- Creates scheduled task(s)
PID:1052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB00C.tmp

MD5
ac094d1f9c58bb8945a03ba941abceac

SHA1
66138d6be81652c28142570240a64400043014a3

SHA256
2f88cf73892a99edb31e5120c6909587760c4499486545974a578926663d7db6

SHA512
dbfdfa70698ee522d59c80ea37045b2f683b73660fcfe8445b7268ec20cd2c23369086b3a8fc9b449484e54fa8cfad772f99fcaea8994e72daf022f28b5d7b80

Download Submit
memory/896-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1052-2-0x0000000000000000-mapping.dmp

Download
memory/1664-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1664-5-0x0000000000446BDE-mapping.dmp

Download
memory/1664-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1664-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads