agenttesla | 3895763b841c38a584cbf2f0154d3c26b08855fdb0ae2c1cdf3ced800bff09bc

General

Target

dasd1q3.exe
Size

953KB
MD5

ec9d8ae5e3f1edb4cb960890df58a50f
SHA1

d1b0064278538dc3cbea88d9f8d783fa88644a8f
SHA256

3895763b841c38a584cbf2f0154d3c26b08855fdb0ae2c1cdf3ced800bff09bc
SHA512

7fa894dbf90937b5624fe284fbabd181f7fc429bcb3362c9182bafb320476f1b526849258748ec56f009dcdbb6ff45cc936e45f4c1aa518ad0551cd7406714ab

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.greatgoldenqlory.com
Port:
587
Username:
kingman@greatgoldenqlory.com
Password:
chibuike12345@@@@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2064-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2064-15-0x000000000043762E-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 api.ipify.org
13 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

dasd1q3.exe

description pid process target process

PID 576 set thread context of 2064 576 dasd1q3.exe dasd1q3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1444 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

dasd1q3.exedasd1q3.exe

pid process

576 dasd1q3.exe
576 dasd1q3.exe
576 dasd1q3.exe
576 dasd1q3.exe
2064 dasd1q3.exe
2064 dasd1q3.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dasd1q3.exedasd1q3.exe

description pid process

Token: SeDebugPrivilege 576 dasd1q3.exe
Token: SeDebugPrivilege 2064 dasd1q3.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dasd1q3.exe

pid process

2064 dasd1q3.exe

flow	ioc
14	api.ipify.org
13	api.ipify.org

description	pid	process	target process
PID 576 set thread context of 2064	576	dasd1q3.exe	dasd1q3.exe

pid	process
1444	schtasks.exe

pid	process
576	dasd1q3.exe
576	dasd1q3.exe
576	dasd1q3.exe
576	dasd1q3.exe
2064	dasd1q3.exe
2064	dasd1q3.exe

description	pid	process
Token: SeDebugPrivilege	576	dasd1q3.exe
Token: SeDebugPrivilege	2064	dasd1q3.exe

pid	process
2064	dasd1q3.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

dasd1q3.exe

description	pid	process	target process
PID 576 wrote to memory of 1444	576	dasd1q3.exe	schtasks.exe
PID 576 wrote to memory of 1444	576	dasd1q3.exe	schtasks.exe
PID 576 wrote to memory of 1444	576	dasd1q3.exe	schtasks.exe
PID 576 wrote to memory of 2064	576	dasd1q3.exe	dasd1q3.exe
PID 576 wrote to memory of 2064	576	dasd1q3.exe	dasd1q3.exe
PID 576 wrote to memory of 2064	576	dasd1q3.exe	dasd1q3.exe
PID 576 wrote to memory of 2064	576	dasd1q3.exe	dasd1q3.exe
PID 576 wrote to memory of 2064	576	dasd1q3.exe	dasd1q3.exe
PID 576 wrote to memory of 2064	576	dasd1q3.exe	dasd1q3.exe
PID 576 wrote to memory of 2064	576	dasd1q3.exe	dasd1q3.exe
PID 576 wrote to memory of 2064	576	dasd1q3.exe	dasd1q3.exe

C:\Users\Admin\AppData\Local\Temp\dasd1q3.exe
"C:\Users\Admin\AppData\Local\Temp\dasd1q3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ESKWassbNtC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9E4.tmp"
2⤵
- Creates scheduled task(s)
PID:1444

C:\Users\Admin\AppData\Local\Temp\dasd1q3.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9E4.tmp
MD5
ceca1597ca93f852c8e4ce255cacc483

SHA1
54fbc9be1743503fcb71c00de37a6aad188e7736

SHA256
dca2f0b725567d8f3134ebcd8f2b1ed818ad2f4975eced061f1bd6263812e6cd

SHA512
87e89d163fee2df2221ec6d3a9c122f30d88a8bfd2bef08bb06cfc0c386e4f80358b397d94d6998164e6decca6e8bfd729d1044812b151cf4f136b2ff713aef1

Download Submit
memory/576-11-0x0000000006410000-0x0000000006411000-memory.dmp

Filesize
4KB

Download
memory/576-3-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/576-6-0x0000000005B30000-0x0000000005B31000-memory.dmp

Filesize
4KB

Download
memory/576-7-0x00000000056D0000-0x00000000056DE000-memory.dmp

Filesize
56KB

Download
memory/576-2-0x0000000073190000-0x000000007387E000-memory.dmp

Filesize
6.9MB

Download
memory/576-9-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/576-5-0x0000000007980000-0x0000000007A3A000-memory.dmp

Filesize
744KB

Download
memory/576-10-0x00000000062E0000-0x0000000006364000-memory.dmp

Filesize
528KB

Download
memory/576-8-0x0000000006730000-0x0000000006731000-memory.dmp

Filesize
4KB

Download
memory/1444-12-0x0000000000000000-mapping.dmp

Download
memory/2064-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2064-15-0x000000000043762E-mapping.dmp

Download
memory/2064-16-0x0000000073190000-0x000000007387E000-memory.dmp

Filesize
6.9MB

Download
memory/2064-21-0x0000000005930000-0x0000000005931000-memory.dmp

Filesize
4KB

Download
memory/2064-22-0x00000000061E0000-0x00000000061E1000-memory.dmp

Filesize
4KB

Download
memory/2064-24-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads