agenttesla | 97ff80592fd49d5b0160ef254df45c82ff6a7649bb8178222c8979f348cce8c7

General

Target

STATEMENT OF ACCOUNT.exe
Size

971KB
MD5

7475293a6bb025005c25a4a25b1ec047
SHA1

2e25d5665740bc2423c40bdd74087fb36eb06a4e
SHA256

97ff80592fd49d5b0160ef254df45c82ff6a7649bb8178222c8979f348cce8c7
SHA512

76409fda28969f640bbcca4a66ff277b6cbf2198a9b7e9c0b432afdfa26c33f1f86f347fac7094f7deb2cedb875228e8142f1f3cab106be79a593ea7b446f7aa

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.insooryaexpresscargo.com
Port:
587
Username:
[email protected]
Password:
SoorYaExp@5812

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1524-4-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1524-5-0x000000000043751E-mapping.dmp	family_agenttesla
behavioral1/memory/1524-6-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1524-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

STATEMENT OF ACCOUNT.exe

description pid process target process

PID 1668 set thread context of 1524 1668 STATEMENT OF ACCOUNT.exe STATEMENT OF ACCOUNT.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1268 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

STATEMENT OF ACCOUNT.exe

pid process

1524 STATEMENT OF ACCOUNT.exe
1524 STATEMENT OF ACCOUNT.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

STATEMENT OF ACCOUNT.exe

description pid process

Token: SeDebugPrivilege 1524 STATEMENT OF ACCOUNT.exe

description	pid	process	target process
PID 1668 set thread context of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe

pid	process
1268	schtasks.exe

pid	process
1524	STATEMENT OF ACCOUNT.exe
1524	STATEMENT OF ACCOUNT.exe

description	pid	process
Token: SeDebugPrivilege	1524	STATEMENT OF ACCOUNT.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

STATEMENT OF ACCOUNT.exeSTATEMENT OF ACCOUNT.exe

description	pid	process	target process
PID 1668 wrote to memory of 1268	1668	STATEMENT OF ACCOUNT.exe	schtasks.exe
PID 1668 wrote to memory of 1268	1668	STATEMENT OF ACCOUNT.exe	schtasks.exe
PID 1668 wrote to memory of 1268	1668	STATEMENT OF ACCOUNT.exe	schtasks.exe
PID 1668 wrote to memory of 1268	1668	STATEMENT OF ACCOUNT.exe	schtasks.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1668 wrote to memory of 1524	1668	STATEMENT OF ACCOUNT.exe	STATEMENT OF ACCOUNT.exe
PID 1524 wrote to memory of 1532	1524	STATEMENT OF ACCOUNT.exe	dw20.exe
PID 1524 wrote to memory of 1532	1524	STATEMENT OF ACCOUNT.exe	dw20.exe
PID 1524 wrote to memory of 1532	1524	STATEMENT OF ACCOUNT.exe	dw20.exe
PID 1524 wrote to memory of 1532	1524	STATEMENT OF ACCOUNT.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe
"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNLCrGEt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C4F.tmp"
2⤵
- Creates scheduled task(s)
PID:1268

C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe
"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:1532

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9C4F.tmp
MD5
2ef1841c41e848052e707217f176051a

SHA1
9adece191f16cdd0b6f59c91a7b82c0bce859dde

SHA256
5c67065288a2f25f254a99cd3a004c32032e02f88ca16aca1588d679a9547da0

SHA512
5e4e8be0f048cad787a7197cdfe3b77321f5b29688608453c1fdc57edf1ca8d9274f30bf5a656d0305af7195e23c10f670e9fd910c715fbc1a9d0edac7f6eb85

Download Submit
memory/1268-2-0x0000000000000000-mapping.dmp

Download
memory/1524-4-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-5-0x000000000043751E-mapping.dmp

Download
memory/1524-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1532-8-0x0000000000000000-mapping.dmp

Download
memory/1532-9-0x0000000001E40000-0x0000000001E51000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads