agenttesla | fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5

General

Target
fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe
Size 551KB
Sample201114-glh2tgrp4e
SHA256 fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5
MD5 49f79a683a2e3f61be490de4e715049d
SHA1 b4f7e8138d74641b0dea33c9cc524d53d8c4d668
SHA512 4af825bfe7873053b3b19ec7abcc328ddc60c91d5b4b4107c9393cc689e7ca443b8acd5c2ecb5070388cea60fb14f3ed73fd7a7068bf4a4763c4e6ea1f1855cc
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
srvc13.turhost.com
Port
587
Username
[email protected]
Password
italik2015

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/652-2-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/652-3-0x00000000004374EE-mapping.dmp	family_agenttesla
behavioral1/memory/652-4-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/652-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
652	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe
652	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	652	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1692	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	29
PID 1080 wrote to memory of 1692	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	29
PID 1080 wrote to memory of 1692	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	29
PID 1080 wrote to memory of 1692	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	29
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 1080 wrote to memory of 652	1080	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	31
PID 652 wrote to memory of 576	652	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	32
PID 652 wrote to memory of 576	652	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	32
PID 652 wrote to memory of 576	652	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	32
PID 652 wrote to memory of 576	652	fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe	32

C:\Users\Admin\AppData\Local\Temp\fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe
"C:\Users\Admin\AppData\Local\Temp\fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QwaFpW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp387E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe
  "C:\Users\Admin\AppData\Local\Temp\fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 516
    3⤵
    PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-7-0x0000000001E00000-0x0000000001E11000-memory.dmp

Download

memory/652-2-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/652-4-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/652-5-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads