agenttesla | d8525b2302c08306f63aa470ca7e081dbf35669af349cd1224d1485ecff71d43

General

Target
PO-37566324756834756_XLS.exe
Size 714KB
Sample201109-tmpywtgene
SHA256 d8525b2302c08306f63aa470ca7e081dbf35669af349cd1224d1485ecff71d43
MD5 b56b7bea3cd94a84afa1024aea59ac6d
SHA1 4d95aee7d7ad2463e0c5a47687057bd390df6430
SHA512 c5791e1a79e8ca31a5ddc14d7ed7c071bfcc518d5e2a5bed8c6c1ec5d08962a3d3bf83833024d6de819d90b173eff0ad06ab0b89415990c24e17926c40f4105f
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.karcek.com.tr
Port
587
Username
[email protected]
Password
Ahmet.6193

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/744-3-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/744-4-0x000000000044C9FE-mapping.dmp	family_agenttesla
behavioral1/memory/744-5-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/744-6-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 744	1320	PO-37566324756834756_XLS.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1484	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1668	REG.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
744	RegSvcs.exe
744	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	PO-37566324756834756_XLS.exe
Token: SeDebugPrivilege	744	RegSvcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1320	PO-37566324756834756_XLS.exe
1320	PO-37566324756834756_XLS.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1484	1320	PO-37566324756834756_XLS.exe	31
PID 1320 wrote to memory of 1484	1320	PO-37566324756834756_XLS.exe	31
PID 1320 wrote to memory of 1484	1320	PO-37566324756834756_XLS.exe	31
PID 1320 wrote to memory of 1484	1320	PO-37566324756834756_XLS.exe	31
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 1320 wrote to memory of 744	1320	PO-37566324756834756_XLS.exe	33
PID 744 wrote to memory of 1668	744	RegSvcs.exe	35
PID 744 wrote to memory of 1668	744	RegSvcs.exe	35
PID 744 wrote to memory of 1668	744	RegSvcs.exe	35
PID 744 wrote to memory of 1668	744	RegSvcs.exe	35
PID 744 wrote to memory of 1560	744	RegSvcs.exe	37
PID 744 wrote to memory of 1560	744	RegSvcs.exe	37
PID 744 wrote to memory of 1560	744	RegSvcs.exe	37
PID 744 wrote to memory of 1560	744	RegSvcs.exe	37

C:\Users\Admin\AppData\Local\Temp\PO-37566324756834756_XLS.exe
"C:\Users\Admin\AppData\Local\Temp\PO-37566324756834756_XLS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BNbKBooAq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC053.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1484
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1668
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-3-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/744-5-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/744-6-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1792-0-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads