agenttesla | 88940cdb5af43de1c9f192bcc96bd258f5632e40c04db36ecff072516821794e

General

Target
696564ad3fbb256c9934f32ce60fe3b2.exe
Size 427KB
Sample201117-2rkphaggm2
SHA256 88940cdb5af43de1c9f192bcc96bd258f5632e40c04db36ecff072516821794e
MD5 696564ad3fbb256c9934f32ce60fe3b2
SHA1 d63e335a751b64229079bad5b81db36380a3cc5f
SHA512 17a4a1ab20a1053f3c57f3bdd2c9a74bbf0c7817aa2fb826889a616ed85a3786bcfca1a83e5d8172efbac13c0821962a0029d6b27e8362dd82185a97c5e4198b
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.mail.com
Port
587
Username
[email protected]
Password
M0ney123

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.mail.com
Port
587
Username
[email protected]
Password
M0ney123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1692-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1692-8-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/1692-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1692-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1580	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	696564ad3fbb256c9934f32ce60fe3b2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	696564ad3fbb256c9934f32ce60fe3b2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	696564ad3fbb256c9934f32ce60fe3b2.exe
1692	696564ad3fbb256c9934f32ce60fe3b2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	696564ad3fbb256c9934f32ce60fe3b2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1692	696564ad3fbb256c9934f32ce60fe3b2.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1580	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	29
PID 1640 wrote to memory of 1580	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	29
PID 1640 wrote to memory of 1580	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	29
PID 1640 wrote to memory of 1580	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	29
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31
PID 1640 wrote to memory of 1692	1640	696564ad3fbb256c9934f32ce60fe3b2.exe	31

C:\Users\Admin\AppData\Local\Temp\696564ad3fbb256c9934f32ce60fe3b2.exe
"C:\Users\Admin\AppData\Local\Temp\696564ad3fbb256c9934f32ce60fe3b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wXPwaH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3B1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1580
- C:\Users\Admin\AppData\Local\Temp\696564ad3fbb256c9934f32ce60fe3b2.exe
  "{path}"
  2⤵
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1692