agenttesla | 86b657e19c75d3110a5f25aa84e9709a6b66d6a3e8bbccfba6ed4402c00269b7

General

Target

JBD6278216733.exe
Size

919KB
MD5

c8b6e53c0790855357c2392a601762bb
SHA1

1d50a1452334cb48f14b8eba17cb40ac150e9732
SHA256

86b657e19c75d3110a5f25aa84e9709a6b66d6a3e8bbccfba6ed4402c00269b7
SHA512

6d489e46eafe7514ddcb578317d561fc0651925dcacf959157e0c18a47ed1b73c7a05893955f00798d3e20b16db66129eb959540e0631d4c8542927e938bfa53

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ionos.co.uk
Port:
587
Username:
info@wjpub.co.uk
Password:
EMmaunel11@!55

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3120-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3120-14-0x00000000004376CE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

JBD6278216733.exe

description pid process target process

PID 2432 set thread context of 3120 2432 JBD6278216733.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2260 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

3120 MSBuild.exe
3120 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 3120 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

3120 MSBuild.exe

description	pid	process	target process
PID 2432 set thread context of 3120	2432	JBD6278216733.exe	MSBuild.exe

pid	process
2260	schtasks.exe

pid	process
3120	MSBuild.exe
3120	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3120	MSBuild.exe

pid	process
3120	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

JBD6278216733.exe

description	pid	process	target process
PID 2432 wrote to memory of 2260	2432	JBD6278216733.exe	schtasks.exe
PID 2432 wrote to memory of 2260	2432	JBD6278216733.exe	schtasks.exe
PID 2432 wrote to memory of 2260	2432	JBD6278216733.exe	schtasks.exe
PID 2432 wrote to memory of 3120	2432	JBD6278216733.exe	MSBuild.exe
PID 2432 wrote to memory of 3120	2432	JBD6278216733.exe	MSBuild.exe
PID 2432 wrote to memory of 3120	2432	JBD6278216733.exe	MSBuild.exe
PID 2432 wrote to memory of 3120	2432	JBD6278216733.exe	MSBuild.exe
PID 2432 wrote to memory of 3120	2432	JBD6278216733.exe	MSBuild.exe
PID 2432 wrote to memory of 3120	2432	JBD6278216733.exe	MSBuild.exe
PID 2432 wrote to memory of 3120	2432	JBD6278216733.exe	MSBuild.exe
PID 2432 wrote to memory of 3120	2432	JBD6278216733.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\JBD6278216733.exe
"C:\Users\Admin\AppData\Local\Temp\JBD6278216733.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qllWYdSwCm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1FBE.tmp"
2⤵
- Creates scheduled task(s)
PID:2260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3120

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1FBE.tmp
MD5
398ae0e31a8e9968f9956525bec57f03

SHA1
995526f4c27dbb876548d452274d2d7d4da505f2

SHA256
7fe3b4639b6510430e8b45db8f4a1c5a1f0ee222a10ac32f39a3d94ae7a6a538

SHA512
9bbfa0ac465da4753b1e40708c598952488f0e185effd6b2d214cb68d1539d0f52cdc12be81a8788cda14b3c1ea5ef8602ce33d47a6c6bbd1f1af83c84c6120f

Download Submit
memory/2260-11-0x0000000000000000-mapping.dmp

Download
memory/2432-6-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/2432-2-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/2432-7-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/2432-8-0x0000000005B80000-0x0000000005B8E000-memory.dmp

Filesize
56KB

Download
memory/2432-9-0x0000000007D50000-0x0000000007DEE000-memory.dmp

Filesize
632KB

Download
memory/2432-10-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

Filesize
4KB

Download
memory/2432-5-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Filesize
4KB

Download
memory/2432-3-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/3120-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3120-14-0x00000000004376CE-mapping.dmp

Download
memory/3120-15-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/3120-20-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/3120-21-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads