agenttesla | f81ffe76cfa1447a52ab6613c83933a5040b49221bb16c5a86ba416b3026240b

General

Target

RFQ Order Diagram.exe
Size

435KB
MD5

53c5f7bcea55b0ae4fe62addeafda2c8
SHA1

4d0cbee8db2201af13f987cb5e7527fcf507e2b5
SHA256

f81ffe76cfa1447a52ab6613c83933a5040b49221bb16c5a86ba416b3026240b
SHA512

79f6c152a008ffd28b63772f940541c56af5379fea8e254596ef05c2d8231d09fa6ecc91b8ec978cf77e938c4aca39f59656ee00dcc4ed5e26f0ff103ecce888

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
Naija81,J

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1332-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1332-5-0x000000000044695E-mapping.dmp	family_agenttesla
behavioral1/memory/1332-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1332-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ Order Diagram.exe

description pid process target process

PID 1108 set thread context of 1332 1108 RFQ Order Diagram.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1848 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1332 RegSvcs.exe
1332 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1332 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1332 RegSvcs.exe

description	pid	process	target process
PID 1108 set thread context of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe

pid	process
1848	schtasks.exe

pid	process
1332	RegSvcs.exe
1332	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1332	RegSvcs.exe

pid	process
1332	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

RFQ Order Diagram.exe

description	pid	process	target process
PID 1108 wrote to memory of 1848	1108	RFQ Order Diagram.exe	schtasks.exe
PID 1108 wrote to memory of 1848	1108	RFQ Order Diagram.exe	schtasks.exe
PID 1108 wrote to memory of 1848	1108	RFQ Order Diagram.exe	schtasks.exe
PID 1108 wrote to memory of 1848	1108	RFQ Order Diagram.exe	schtasks.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe
PID 1108 wrote to memory of 1332	1108	RFQ Order Diagram.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\RFQ Order Diagram.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ Order Diagram.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wsfzaoPR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE44.tmp"
2⤵
- Creates scheduled task(s)
PID:1848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEE44.tmp

MD5
2677f33c10e9d82ac573de9a6675ad79

SHA1
d1a6bc45364ebc3e53a6011e944be334a0e34b74

SHA256
1a0d6f68c9f2e9db63335d7fb9131971db3b20b5f7b1f6f4dc67aa6877bb496b

SHA512
912f2bda4cc7a03d59e0cb81bbc9693895582cbd6e632e09844aa2c5faf494038939d5d512da135feba14230811433f3417efdbaa2b363b99801494f940aa945

Download Submit
memory/1108-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1332-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1332-5-0x000000000044695E-mapping.dmp

Download
memory/1332-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1332-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1848-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads