agenttesla | 9a8ffb097e2d4a4788ed1455d23a73e91a8a7b1ae4b9b1152e63fc1f7730ed89

General

Target

3a3270aced9ac5f099542a5318d62e5f.exe
Size

936KB
MD5

3a3270aced9ac5f099542a5318d62e5f
SHA1

77e5ac9bb4f0d95dc40dc2824c8f50f7ddf44ebc
SHA256

9a8ffb097e2d4a4788ed1455d23a73e91a8a7b1ae4b9b1152e63fc1f7730ed89
SHA512

47df0b24b4ee57b4e474dc6cd8c0501988289a4131a42c718346c98dddfd063f088f7c12ec52c4bc08eca73b76d8104f46eaff8619cead24157bf90dbd51bee1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.godforeu.com
Port:
587
Username:
[email protected]
Password:
O8k#Pz4sk:w_

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/656-11-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/656-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/656-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

3a3270aced9ac5f099542a5318d62e5f.exe

description pid process target process

PID 1752 set thread context of 656 1752 3a3270aced9ac5f099542a5318d62e5f.exe 3a3270aced9ac5f099542a5318d62e5f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1572 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3a3270aced9ac5f099542a5318d62e5f.exe

pid process

656 3a3270aced9ac5f099542a5318d62e5f.exe
656 3a3270aced9ac5f099542a5318d62e5f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3a3270aced9ac5f099542a5318d62e5f.exe

description pid process

Token: SeDebugPrivilege 656 3a3270aced9ac5f099542a5318d62e5f.exe

description	pid	process	target process
PID 1752 set thread context of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe

pid	process
1572	schtasks.exe

pid	process
656	3a3270aced9ac5f099542a5318d62e5f.exe
656	3a3270aced9ac5f099542a5318d62e5f.exe

description	pid	process
Token: SeDebugPrivilege	656	3a3270aced9ac5f099542a5318d62e5f.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

3a3270aced9ac5f099542a5318d62e5f.exe

description	pid	process	target process
PID 1752 wrote to memory of 1572	1752	3a3270aced9ac5f099542a5318d62e5f.exe	schtasks.exe
PID 1752 wrote to memory of 1572	1752	3a3270aced9ac5f099542a5318d62e5f.exe	schtasks.exe
PID 1752 wrote to memory of 1572	1752	3a3270aced9ac5f099542a5318d62e5f.exe	schtasks.exe
PID 1752 wrote to memory of 1572	1752	3a3270aced9ac5f099542a5318d62e5f.exe	schtasks.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe
PID 1752 wrote to memory of 656	1752	3a3270aced9ac5f099542a5318d62e5f.exe	3a3270aced9ac5f099542a5318d62e5f.exe

C:\Users\Admin\AppData\Local\Temp\3a3270aced9ac5f099542a5318d62e5f.exe
"C:\Users\Admin\AppData\Local\Temp\3a3270aced9ac5f099542a5318d62e5f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OZaawewgVnTHTz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp22DC.tmp"
2⤵
- Creates scheduled task(s)
PID:1572

C:\Users\Admin\AppData\Local\Temp\3a3270aced9ac5f099542a5318d62e5f.exe
"C:\Users\Admin\AppData\Local\Temp\3a3270aced9ac5f099542a5318d62e5f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp22DC.tmp
MD5
abe56ecd00a13f5537aeffc32847f02f

SHA1
3fafdf503fceef662ac9dfd132c4b709b17cec40

SHA256
aee2461db5229794abcd20ae34d085c5fa66c80596c4d7fbbe19701aa578ade8

SHA512
43c66fb4b23716002664491a007646039db7ec85d6b6096d0317c708656d04e0fe4b3257ffe322318e7744212400adf65dd5fc415e2eb40f3ba5d05ccd8a15da

Download Submit
memory/656-11-0x00000000004374CE-mapping.dmp

Download
memory/656-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/656-12-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/656-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/656-15-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1572-8-0x0000000000000000-mapping.dmp

Download
memory/1752-2-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/1752-3-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/1752-5-0x0000000004180000-0x0000000004181000-memory.dmp

Filesize
4KB

Download
memory/1752-6-0x0000000000AB0000-0x0000000000AB3000-memory.dmp

Filesize
12KB

Download
memory/1752-7-0x0000000004D70000-0x0000000004DD8000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads