agenttesla | 2435735bff63b11f82baaafe0737904c936b420f5145d01609a0a0d8c8ce70c9

General

Target

SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe
Size

479KB
MD5

65e9b0b079f9a157dc0b069705b4c9b4
SHA1

df3672e10800f9b3b418042c21b7379e32789862
SHA256

2435735bff63b11f82baaafe0737904c936b420f5145d01609a0a0d8c8ce70c9
SHA512

ca5ce6fb878587407a2bf3b4956d05cf21cf24f3cea66a73a37daa362c2f2e5fdfecaf9b7b8610d0c7284642bced56036c28a7f2f16ccabfdbc27e845bba6185

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.newvenna121llc.com
Port:
587
Username:
info@newvenna121llc.com
Password:
fardin09123405057

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1696-2-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1696-3-0x000000000044CD7E-mapping.dmp	family_agenttesla
behavioral1/memory/1696-5-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1696-4-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe

description pid process target process

PID 288 set thread context of 1696 288 SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1488 schtasks.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

1836 REG.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1696 RegSvcs.exe
1696 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1696 RegSvcs.exe

description	pid	process	target process
PID 288 set thread context of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe

pid	process
1488	schtasks.exe

pid	process
1836	REG.exe

pid	process
1696	RegSvcs.exe
1696	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1696	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exeRegSvcs.exe

description	pid	process	target process
PID 288 wrote to memory of 1488	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	schtasks.exe
PID 288 wrote to memory of 1488	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	schtasks.exe
PID 288 wrote to memory of 1488	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	schtasks.exe
PID 288 wrote to memory of 1488	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	schtasks.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 288 wrote to memory of 1696	288	SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe	RegSvcs.exe
PID 1696 wrote to memory of 1836	1696	RegSvcs.exe	REG.exe
PID 1696 wrote to memory of 1836	1696	RegSvcs.exe	REG.exe
PID 1696 wrote to memory of 1836	1696	RegSvcs.exe	REG.exe
PID 1696 wrote to memory of 1836	1696	RegSvcs.exe	REG.exe
PID 1696 wrote to memory of 1296	1696	RegSvcs.exe	netsh.exe
PID 1696 wrote to memory of 1296	1696	RegSvcs.exe	netsh.exe
PID 1696 wrote to memory of 1296	1696	RegSvcs.exe	netsh.exe
PID 1696 wrote to memory of 1296	1696	RegSvcs.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.47097.1482.12593.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OOHzPYNvODDiTZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp51F7.tmp"
2⤵
- Creates scheduled task(s)
PID:1488

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:1836

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1296

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp51F7.tmp
MD5
2ce33423ca127cfd76dc5ecd199e34b1

SHA1
defe98b0565200a38909fb592f3c6df2efaafbd9

SHA256
cb1ed0f5e8089eff9bacbe2a94b2b4fb2a3911e7cb791e3905a9b61917f6ac17

SHA512
fd3b4888222624fe42856d7db2d91de4738d6236efe8604d6c9df363c5920598cadffe71b560515f591039d66d92d229cf22a75219a843538c53256477b8ba1d

Download Submit
memory/1296-7-0x0000000000000000-mapping.dmp

Download
memory/1488-0-0x0000000000000000-mapping.dmp

Download
memory/1696-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1696-3-0x000000000044CD7E-mapping.dmp

Download
memory/1696-5-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1696-4-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1836-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads