agenttesla | 9696a44528dca762c88b2a88292d2fcb4a6ab16ce5ed1057a4faf2ba2c179d04

General

Target

pickup receipt,DOC.exe
Size

754KB
MD5

15305eed3c883a3676fc491085a8a10d
SHA1

0db30687fbe8fab485255ebee73ecf54fc136052
SHA256

9696a44528dca762c88b2a88292d2fcb4a6ab16ce5ed1057a4faf2ba2c179d04
SHA512

26ec7db496978d7d8f5518807d122ab5dd4cac84953eb2bfb5c15575242c7a404e5a137b15bce3d3201d1ad040a3802d3a9d09b850364d2e66a107d64cd2baa9

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
eazi@gdaslc.com
Password:
mmm777

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/348-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/348-11-0x000000000043781E-mapping.dmp	family_agenttesla
behavioral1/memory/348-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

pickup receipt,DOC.exe

description pid process target process

PID 1964 set thread context of 348 1964 pickup receipt,DOC.exe pickup receipt,DOC.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

604 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pickup receipt,DOC.exe

pid process

348 pickup receipt,DOC.exe
348 pickup receipt,DOC.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

pickup receipt,DOC.exe

description pid process

Token: SeDebugPrivilege 348 pickup receipt,DOC.exe

description	pid	process	target process
PID 1964 set thread context of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe

pid	process
604	schtasks.exe

pid	process
348	pickup receipt,DOC.exe
348	pickup receipt,DOC.exe

description	pid	process
Token: SeDebugPrivilege	348	pickup receipt,DOC.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

pickup receipt,DOC.exe

description	pid	process	target process
PID 1964 wrote to memory of 604	1964	pickup receipt,DOC.exe	schtasks.exe
PID 1964 wrote to memory of 604	1964	pickup receipt,DOC.exe	schtasks.exe
PID 1964 wrote to memory of 604	1964	pickup receipt,DOC.exe	schtasks.exe
PID 1964 wrote to memory of 604	1964	pickup receipt,DOC.exe	schtasks.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe
PID 1964 wrote to memory of 348	1964	pickup receipt,DOC.exe	pickup receipt,DOC.exe

C:\Users\Admin\AppData\Local\Temp\pickup receipt,DOC.exe
"C:\Users\Admin\AppData\Local\Temp\pickup receipt,DOC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wxQVoeKKOYitD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE051.tmp"
2⤵
- Creates scheduled task(s)
PID:604

C:\Users\Admin\AppData\Local\Temp\pickup receipt,DOC.exe
"C:\Users\Admin\AppData\Local\Temp\pickup receipt,DOC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:348

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE051.tmp
MD5
516db238e917f93a0470e012cea5bfdf

SHA1
12bc2423c3eae5ce9e9d91a1b04ede29be7fa748

SHA256
cc6004f403878ee7a865c5d8c0acb390351fb9d0c193f396294ac4a27a4caf8e

SHA512
60e24effe7eb7af0ccbc738af9dd3a4de531a176404db6b5776f8a48f18980727edae8ffd4732df75b97e03dda95af6c2c0a34d28f219990df4106af49a5e1bf

Download Submit
memory/348-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/348-11-0x000000000043781E-mapping.dmp

Download
memory/348-12-0x0000000073D80000-0x000000007446E000-memory.dmp

Filesize
6.9MB

Download
memory/348-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/348-15-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/604-8-0x0000000000000000-mapping.dmp

Download
memory/1964-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1964-3-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1964-5-0x00000000004A0000-0x00000000004C3000-memory.dmp

Filesize
140KB

Download
memory/1964-6-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/1964-7-0x0000000005010000-0x000000000507F000-memory.dmp

Filesize
444KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads