agenttesla | 1321e390a0141decaf5a8dab00fe02bc111ece34f446115842c6afa068c7fd3c

General

Target

HTG-69784869.exe
Size

778KB
MD5

652a7d27ddd37e4ce384bc1957c00b9e
SHA1

fe2e68496eed6e1f789e1befe4f4d349d12e4143
SHA256

1321e390a0141decaf5a8dab00fe02bc111ece34f446115842c6afa068c7fd3c
SHA512

536aee0303b8379c57a921c4a504f81d70c73634bb2d34516b3b71943d2e8f5caf59f44de5b67e7838dd1909bb82d0c77aa9a14fb0a36a2321d9e5506e641cd1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3164-10-0x0000000000400000-0x000000000044B000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

Processes:

pscvelqdj.exe987tlsr.exe

pid process

3984 pscvelqdj.exe
3164 987tlsr.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

pscvelqdj.exe

description pid process target process

PID 3984 set thread context of 3164 3984 pscvelqdj.exe 987tlsr.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 3984 set thread context of 3164	3984	pscvelqdj.exe	987tlsr.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

pscvelqdj.exe987tlsr.exe

pid	process
3984	pscvelqdj.exe
3984	pscvelqdj.exe
3984	pscvelqdj.exe
3984	pscvelqdj.exe
3984	pscvelqdj.exe
3984	pscvelqdj.exe
3984	pscvelqdj.exe
3984	pscvelqdj.exe
3164	987tlsr.exe
3164	987tlsr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pscvelqdj.exe

pid process

3984 pscvelqdj.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

987tlsr.exe

description pid process

Token: SeDebugPrivilege 3164 987tlsr.exe

description	pid	process
Token: SeDebugPrivilege	3164	987tlsr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

HTG-69784869.exepscvelqdj.exe

description	pid	process	target process
PID 3116 wrote to memory of 3984	3116	HTG-69784869.exe	pscvelqdj.exe
PID 3116 wrote to memory of 3984	3116	HTG-69784869.exe	pscvelqdj.exe
PID 3116 wrote to memory of 3984	3116	HTG-69784869.exe	pscvelqdj.exe
PID 3984 wrote to memory of 3164	3984	pscvelqdj.exe	987tlsr.exe
PID 3984 wrote to memory of 3164	3984	pscvelqdj.exe	987tlsr.exe
PID 3984 wrote to memory of 3164	3984	pscvelqdj.exe	987tlsr.exe
PID 3984 wrote to memory of 3164	3984	pscvelqdj.exe	987tlsr.exe

C:\Users\Admin\AppData\Local\Temp\HTG-69784869.exe
"C:\Users\Admin\AppData\Local\Temp\HTG-69784869.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Users\Admin\AppData\Local\Temp\pscvelqdj.exe
C:\Users\Admin\AppData\Local\Temp\pscvelqdj.exe C:\Users\Admin\AppData\Local\Temp\tcpgayny.w
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3984

C:\Users\Admin\AppData\Local\Temp\987tlsr.exe
C:\Users\Admin\AppData\Local\Temp\pscvelqdj.exe C:\Users\Admin\AppData\Local\Temp\tcpgayny.w
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\987tlsr.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pscvelqdj.exe
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pscvelqdj.exe
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tcpgayny.w
MD5
6ae0b4f6ae333dfe33829ea82061ca51

SHA1
41385437464d9140225d857018ad1e137abec176

SHA256
820378722e43cd9b762dcbfc7998f4e4386b321094caaa783394a19362701af6

SHA512
779a4fef5ca308840fc273f6439dd6845475fb3f28a5fcfbdd438fb6647c7f7f5307dc6eeb974108813172401b19330c78c5b6c07f27355fbec001db2056efbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxcdnq.qjp
MD5
50974f348d2efa2973548fad944c5945

SHA1
78b80e51f91d62e842c498088c29877bab3c9140

SHA256
fbbba0bbfc07689097f510175993ce8325e417d295ff009c534a533ee7aa2bbf

SHA512
e3c72cb6f4c1a21e511d8c84948ee9109b43974ae0f8490c3387c5e8978d92777fc73cebe901a2211e2b35d5e727f2c1ea01ae67dd8f78bb026178df53cabb71

Download Submit
memory/3164-7-0x000000000040188B-mapping.dmp

Download
memory/3164-10-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3164-11-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3164-13-0x0000000002522000-0x0000000002524000-memory.dmp

Filesize
8KB

Download
memory/3164-12-0x0000000002521000-0x0000000002522000-memory.dmp

Filesize
4KB

Download
memory/3164-14-0x0000000002527000-0x0000000002528000-memory.dmp

Filesize
4KB

Download
memory/3164-15-0x0000000002528000-0x0000000002529000-memory.dmp

Filesize
4KB

Download
memory/3164-16-0x000000000252D000-0x000000000252F000-memory.dmp

Filesize
8KB

Download
memory/3984-2-0x0000000000000000-mapping.dmp

Download
memory/3984-9-0x0000000000960000-0x0000000000962000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads