agenttesla | d32e5e98f0b4d284046a50db5237b4326a54943e185b57b0e6e76874479724fe

General

Target

RFQ #120032020.exe
Size

732KB
MD5

e1fd408fd5c308ae16133649a522db80
SHA1

218a7bfdb2d1826422773d7a9ba4269b316ed2ae
SHA256

d32e5e98f0b4d284046a50db5237b4326a54943e185b57b0e6e76874479724fe
SHA512

32d7bf5566d4a8716434efd6027e35e92653bf43af5e980f523d96183313a0d47c75429fea3f30d25acd4259285ebd3b67ab2f8abfa8e6d719b65bb5f6a4479b

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mdist.us
Port:
587
Username:
[email protected]
Password:
Receiving#4321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1776-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1776-5-0x000000000044712E-mapping.dmp	family_agenttesla
behavioral1/memory/1776-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1776-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1056 set thread context of 1776	1056	RFQ #120032020.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1216	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1592	REG.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1776	RegSvcs.exe
1776	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1216	1056	RFQ #120032020.exe	26
PID 1056 wrote to memory of 1216	1056	RFQ #120032020.exe	26
PID 1056 wrote to memory of 1216	1056	RFQ #120032020.exe	26
PID 1056 wrote to memory of 1216	1056	RFQ #120032020.exe	26
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1056 wrote to memory of 1776	1056	RFQ #120032020.exe	28
PID 1776 wrote to memory of 1592	1776	RegSvcs.exe	30
PID 1776 wrote to memory of 1592	1776	RegSvcs.exe	30
PID 1776 wrote to memory of 1592	1776	RegSvcs.exe	30
PID 1776 wrote to memory of 1592	1776	RegSvcs.exe	30

C:\Users\Admin\AppData\Local\Temp\RFQ #120032020.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ #120032020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zBeCvrzUJJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA8AD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
    3⤵
    - Modifies registry key
    PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1776-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1776-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads