agenttesla | cab96fce527e6e090f6b3ea363017c63aaf1a40f693d6f5cc0e99945e1abd957

General

Target

43e914caf7c961621b5905fb1b8d9693.exe
Size

949KB
MD5

43e914caf7c961621b5905fb1b8d9693
SHA1

288f6a1b5731e88d6c2702a63ca6ac4f816e53b1
SHA256

cab96fce527e6e090f6b3ea363017c63aaf1a40f693d6f5cc0e99945e1abd957
SHA512

53cc5fae8318f9f2e44ab512fe74aaf280695b41066827b686c79cd84edcccb178539090c5199912ca2ae5e70f1ea346354cc37e2a600149f6cd91b3f59eafdd

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1354395790:AAGs5t1VElMZzeygESEl5DtA0jHdLInLstE/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/992-16-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/992-17-0x00000000004376EE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.ipify.org
16 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

43e914caf7c961621b5905fb1b8d9693.exe

description pid process target process

PID 4640 set thread context of 992 4640 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4164 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

43e914caf7c961621b5905fb1b8d9693.exe43e914caf7c961621b5905fb1b8d9693.exe

pid process

4640 43e914caf7c961621b5905fb1b8d9693.exe
992 43e914caf7c961621b5905fb1b8d9693.exe
992 43e914caf7c961621b5905fb1b8d9693.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

43e914caf7c961621b5905fb1b8d9693.exe43e914caf7c961621b5905fb1b8d9693.exe

description pid process

Token: SeDebugPrivilege 4640 43e914caf7c961621b5905fb1b8d9693.exe
Token: SeDebugPrivilege 992 43e914caf7c961621b5905fb1b8d9693.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

43e914caf7c961621b5905fb1b8d9693.exe

pid process

992 43e914caf7c961621b5905fb1b8d9693.exe

flow	ioc
15	api.ipify.org
16	api.ipify.org

description	pid	process	target process
PID 4640 set thread context of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe

pid	process
4164	schtasks.exe

pid	process
4640	43e914caf7c961621b5905fb1b8d9693.exe
992	43e914caf7c961621b5905fb1b8d9693.exe
992	43e914caf7c961621b5905fb1b8d9693.exe

description	pid	process
Token: SeDebugPrivilege	4640	43e914caf7c961621b5905fb1b8d9693.exe
Token: SeDebugPrivilege	992	43e914caf7c961621b5905fb1b8d9693.exe

pid	process
992	43e914caf7c961621b5905fb1b8d9693.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

43e914caf7c961621b5905fb1b8d9693.exe

description	pid	process	target process
PID 4640 wrote to memory of 4164	4640	43e914caf7c961621b5905fb1b8d9693.exe	schtasks.exe
PID 4640 wrote to memory of 4164	4640	43e914caf7c961621b5905fb1b8d9693.exe	schtasks.exe
PID 4640 wrote to memory of 4164	4640	43e914caf7c961621b5905fb1b8d9693.exe	schtasks.exe
PID 4640 wrote to memory of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe
PID 4640 wrote to memory of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe
PID 4640 wrote to memory of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe
PID 4640 wrote to memory of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe
PID 4640 wrote to memory of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe
PID 4640 wrote to memory of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe
PID 4640 wrote to memory of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe
PID 4640 wrote to memory of 992	4640	43e914caf7c961621b5905fb1b8d9693.exe	43e914caf7c961621b5905fb1b8d9693.exe

C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe
"C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sOJRla" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1B0B.tmp"
2⤵
- Creates scheduled task(s)
PID:4164

C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe
"C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\43e914caf7c961621b5905fb1b8d9693.exe.log

MD5
65f1f0c7993639f9f9e1d524224a2c93

SHA1
5b51a6a56f3041dbc2d3f510252bbe68ffbbc59c

SHA256
e582e80a644a998d1b2958bdcb0cd1e899076befa7c5e868d033b3fe75a2ca93

SHA512
3e8953968bbc31f3105a0df28b95edfb4cee8af78ec527d47707b82e3d5fc2aa725fca574de3c963da53614e60d282408b21d075eed007be25679e9458bf1c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1B0B.tmp

MD5
54a5f06a9a24b653ce665a087d936661

SHA1
4c72a669d0062a2001088e7d2b778a3b78f51110

SHA256
0da120749420a8164c32aed688a396b15dd12bc5a131163f5f8b72e90da88669

SHA512
5d292c4561e7de07b6a10b26ba156cbf0aa94df269f52a58c1073d454e9e2aad254d592eec215379d8df5641a117778f3195f160b8162e201cb07d9e39d51245

Download Submit
memory/992-29-0x0000000004FD1000-0x0000000004FD2000-memory.dmp

Filesize
4KB

Download
memory/992-26-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download
memory/992-25-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/992-24-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/992-19-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download
memory/992-17-0x00000000004376EE-mapping.dmp

Download
memory/992-16-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4164-14-0x0000000000000000-mapping.dmp

Download
memory/4640-8-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/4640-13-0x0000000005BF0000-0x0000000005C59000-memory.dmp

Filesize
420KB

Download
memory/4640-12-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/4640-11-0x0000000004B40000-0x0000000004B43000-memory.dmp

Filesize
12KB

Download
memory/4640-10-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/4640-9-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/4640-2-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download
memory/4640-7-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/4640-6-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/4640-5-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/4640-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads