agenttesla | c935dd6128830f5506af13b5e46043d4f8b2781e345936f06964722865ab0c6e

General

Target

lWAGihypmY0YXgh.exe
Size

812KB
MD5

4c0f12aff6638202b87a156b8bcabb8a
SHA1

4742ebd00f82dcc2a520e2165d5c941e6cba4936
SHA256

c935dd6128830f5506af13b5e46043d4f8b2781e345936f06964722865ab0c6e
SHA512

d77b8b4f17a840897add306e358a97a19f1be2e7605741efa8386f7e8fb23c1664228a47f9df8a3b4cf8cd0b311c1ee58e82f18bc4615273103e3fd080473322

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sardaplywood.com
Port:
587
Username:
[email protected]
Password:
sup123st45

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/324-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/324-11-0x000000000043763E-mapping.dmp	family_agenttesla
behavioral1/memory/324-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

lWAGihypmY0YXgh.exe

description pid process target process

PID 1064 set thread context of 324 1064 lWAGihypmY0YXgh.exe lWAGihypmY0YXgh.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1216 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

lWAGihypmY0YXgh.exe

pid process

324 lWAGihypmY0YXgh.exe
324 lWAGihypmY0YXgh.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

lWAGihypmY0YXgh.exe

description pid process

Token: SeDebugPrivilege 324 lWAGihypmY0YXgh.exe

description	pid	process	target process
PID 1064 set thread context of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe

pid	process
1216	schtasks.exe

pid	process
324	lWAGihypmY0YXgh.exe
324	lWAGihypmY0YXgh.exe

description	pid	process
Token: SeDebugPrivilege	324	lWAGihypmY0YXgh.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

lWAGihypmY0YXgh.exe

description	pid	process	target process
PID 1064 wrote to memory of 1216	1064	lWAGihypmY0YXgh.exe	schtasks.exe
PID 1064 wrote to memory of 1216	1064	lWAGihypmY0YXgh.exe	schtasks.exe
PID 1064 wrote to memory of 1216	1064	lWAGihypmY0YXgh.exe	schtasks.exe
PID 1064 wrote to memory of 1216	1064	lWAGihypmY0YXgh.exe	schtasks.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe
PID 1064 wrote to memory of 324	1064	lWAGihypmY0YXgh.exe	lWAGihypmY0YXgh.exe

C:\Users\Admin\AppData\Local\Temp\lWAGihypmY0YXgh.exe
"C:\Users\Admin\AppData\Local\Temp\lWAGihypmY0YXgh.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HQNbDThyljJh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB30.tmp"
2⤵
- Creates scheduled task(s)
PID:1216

C:\Users\Admin\AppData\Local\Temp\lWAGihypmY0YXgh.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFB30.tmp
MD5
fbc4e0fce226370db6efc5fa09df92cd

SHA1
e4059edc49c21f91ca5c03d6d6a8c7ab643a0370

SHA256
9cc1421f4fa65289391d0f90145aa68904ee5c5b722a2e73005a4f8bda810da6

SHA512
28cbff46e9e445336be1bef64f203f0a2c379107d8582749ad06ae0f1027e5addf8ef81b338d8f675e36c4374739d4c0b1c587a71bad4f1402db2434a16bc0c0

Download Submit
memory/324-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/324-11-0x000000000043763E-mapping.dmp

Download
memory/324-12-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/324-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/324-15-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/1064-2-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/1064-3-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/1064-5-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/1064-6-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1064-7-0x00000000044C0000-0x0000000004517000-memory.dmp

Filesize
348KB

Download
memory/1216-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads