agenttesla | b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0

General

Target

b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
Size

676KB
MD5

098dd487d8e4103b276dcce6e8216353
SHA1

f5ea16093c1e2027b2ba09b05bc14d16dccf3319
SHA256

b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0
SHA512

a31a48d2c1e2904400022b1721e606756da759d3ac1a9ced7db259c12bd7e3426a584ac8e0505c085d95c7c91711ae3ab6a4f4f4c7902d4c6e7c6ad56ef1fe66

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.airlndia.in
Port:
587
Username:
ikorigin@airlndia.in
Password:
pkqNqbW9

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.airlndia.in
Port:
587
Username:
ikorigin@airlndia.in
Password:
pkqNqbW9

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1520-10-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral2/memory/1520-11-0x00000000004613FE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe

description	pid	process	target process
PID 580 set thread context of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exeb6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe

pid	process
580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
1520	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
1520	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exeb6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe

description	pid	process
Token: SeDebugPrivilege	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
Token: SeDebugPrivilege	1520	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe

description	pid	process	target process
PID 580 wrote to memory of 2268	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 2268	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 2268	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
PID 580 wrote to memory of 1520	580	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe	b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe

C:\Users\Admin\AppData\Local\Temp\b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
"C:\Users\Admin\AppData\Local\Temp\b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
"{path}"
2⤵
PID:2268

C:\Users\Admin\AppData\Local\Temp\b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0.exe.log
MD5
3fed8d1dd11972a6e2603bb2d73a3ee5

SHA1
7ecb7f64ade7b91c5815da647e84167c3d95afb4

SHA256
eecf6c0575dc995a485d46a5daaa66f58229e552f16782d873834d218ab17551

SHA512
ca6059eb67f800cc666d5146d24070abf5ee08209f8f9d1668a0ca2201eb3f6fa013c2d807b09925e12b82c37686980fcc26a6a5e4a5ba129c4b2a585961d3bb

Download Submit
memory/580-7-0x0000000008B90000-0x0000000008B91000-memory.dmp

Filesize
4KB

Download
memory/580-9-0x00000000073E0000-0x000000000746B000-memory.dmp

Filesize
556KB

Download
memory/580-4-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/580-5-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/580-6-0x00000000090C0000-0x00000000090C1000-memory.dmp

Filesize
4KB

Download
memory/580-0-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/580-8-0x0000000005AC0000-0x0000000005AD4000-memory.dmp

Filesize
80KB

Download
memory/580-3-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/580-1-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1520-11-0x00000000004613FE-mapping.dmp

Download
memory/1520-10-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1520-13-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/1520-18-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/1520-19-0x0000000005E90000-0x0000000005E91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads