agenttesla | 86b657e19c75d3110a5f25aa84e9709a6b66d6a3e8bbccfba6ed4402c00269b7

General

Target

JBD6278216733.exe
Size

919KB
MD5

c8b6e53c0790855357c2392a601762bb
SHA1

1d50a1452334cb48f14b8eba17cb40ac150e9732
SHA256

86b657e19c75d3110a5f25aa84e9709a6b66d6a3e8bbccfba6ed4402c00269b7
SHA512

6d489e46eafe7514ddcb578317d561fc0651925dcacf959157e0c18a47ed1b73c7a05893955f00798d3e20b16db66129eb959540e0631d4c8542927e938bfa53

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ionos.co.uk
Port:
587
Username:
info@wjpub.co.uk
Password:
EMmaunel11@!55

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/292-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/292-10-0x00000000004376CE-mapping.dmp	family_agenttesla
behavioral1/memory/292-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/292-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

JBD6278216733.exe

description pid process target process

PID 532 set thread context of 292 532 JBD6278216733.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1336 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

292 MSBuild.exe
292 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 292 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

292 MSBuild.exe

description	pid	process	target process
PID 532 set thread context of 292	532	JBD6278216733.exe	MSBuild.exe

pid	process
1336	schtasks.exe

pid	process
292	MSBuild.exe
292	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	292	MSBuild.exe

pid	process
292	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

JBD6278216733.exe

description	pid	process	target process
PID 532 wrote to memory of 1336	532	JBD6278216733.exe	schtasks.exe
PID 532 wrote to memory of 1336	532	JBD6278216733.exe	schtasks.exe
PID 532 wrote to memory of 1336	532	JBD6278216733.exe	schtasks.exe
PID 532 wrote to memory of 1336	532	JBD6278216733.exe	schtasks.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe
PID 532 wrote to memory of 292	532	JBD6278216733.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\JBD6278216733.exe
"C:\Users\Admin\AppData\Local\Temp\JBD6278216733.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qllWYdSwCm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD356.tmp"
2⤵
- Creates scheduled task(s)
PID:1336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD356.tmp
MD5
64c2c34ca4d75a21edd7839ff4019572

SHA1
18a087084d32f60be8985cc2e90ddb1b60e69da1

SHA256
10fc47bdde6124f86cab18336e7f59efe7fe8666490a42c316ada13f46327d54

SHA512
698db100e89238fc5692460a6d672449170fd894e2e2d352e9959e8ee28fca5f150f5de4ebbd1cabd51744b23e48d2b6276501bcf5cbad70795d6920c635695b

Download Submit
memory/292-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/292-10-0x00000000004376CE-mapping.dmp

Download
memory/292-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/292-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/292-13-0x00000000732D0000-0x00000000739BE000-memory.dmp

Filesize
6.9MB

Download
memory/532-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/532-3-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/532-5-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/532-6-0x0000000005740000-0x00000000057DE000-memory.dmp

Filesize
632KB

Download
memory/1336-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads