agenttesla | 708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089

General

Target

para.exe
Size

928KB
MD5

80b51e872031a2befeb9a0a13e6fc480
SHA1

caebbab5349f57d92182ce56ef4bf71ea60226a7
SHA256

708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089
SHA512

12e9db89be76788d238f8a7f3114534b50b953b9ef619f84b0a124fba77f5e7d4aa00ae8f6ac3fdb16ecd1398950d6bdadfa43e9ec59b6d59667df5ac3d60879

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.godforeu.com
Port:
587
Username:
[email protected]
Password:
O8k#Pz4sk:w_

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1484-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1484-11-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/1484-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

para.exe

description pid process target process

PID 844 set thread context of 1484 844 para.exe para.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

864 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

para.exe

pid process

1484 para.exe
1484 para.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

para.exe

description pid process

Token: SeDebugPrivilege 1484 para.exe

description	pid	process	target process
PID 844 set thread context of 1484	844	para.exe	para.exe

pid	process
864	schtasks.exe

pid	process
1484	para.exe
1484	para.exe

description	pid	process
Token: SeDebugPrivilege	1484	para.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

para.exe

description	pid	process	target process
PID 844 wrote to memory of 864	844	para.exe	schtasks.exe
PID 844 wrote to memory of 864	844	para.exe	schtasks.exe
PID 844 wrote to memory of 864	844	para.exe	schtasks.exe
PID 844 wrote to memory of 864	844	para.exe	schtasks.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe
PID 844 wrote to memory of 1484	844	para.exe	para.exe

C:\Users\Admin\AppData\Local\Temp\para.exe
"C:\Users\Admin\AppData\Local\Temp\para.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\neHneiobyhcrJJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C64.tmp"
2⤵
- Creates scheduled task(s)
PID:864

C:\Users\Admin\AppData\Local\Temp\para.exe
"C:\Users\Admin\AppData\Local\Temp\para.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3C64.tmp
MD5
29636f47e93d825fa6972d3a21f8cf9b

SHA1
6d329e5c4e167df8e79b93eca285708e8a795f16

SHA256
108fae91b68c4ebca4be09814922686f2611ce74321fa784cf86c00cb5679b39

SHA512
1b0b4bd0c8dbece867bafb7eba23c244454efd2b2a8ef2ec1eac1bcd4d3da33beb0e40f735802deb91b2e3ca759ecf214c8330f1560b3370178be8970d54e421

Download Submit
memory/844-2-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/844-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/844-5-0x0000000000550000-0x0000000000553000-memory.dmp

Filesize
12KB

Download
memory/844-6-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/844-7-0x0000000005230000-0x000000000529B000-memory.dmp

Filesize
428KB

Download
memory/864-8-0x0000000000000000-mapping.dmp

Download
memory/1484-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1484-11-0x00000000004374CE-mapping.dmp

Download
memory/1484-12-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1484-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1484-15-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads