agenttesla | 102b0bdae4e027e3e115490a1fe904b1a9f4fd9e4e52243719ee1167ec4ed62a

General

Target

e464a2d9934812818fc4f5e410399ae3.exe
Size

526KB
MD5

e464a2d9934812818fc4f5e410399ae3
SHA1

30ff845d5d2475bd3cabd77bf3f07abad8e2ea21
SHA256

102b0bdae4e027e3e115490a1fe904b1a9f4fd9e4e52243719ee1167ec4ed62a
SHA512

60534f80fddf03bf092fbcfef59586c035417be579be201a21586520e94f13a0393bdd6d4d1ccfed0634d458919e99058537fb93c1f00aad991c5dafdf4ab305

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
@Mexico1.,

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2088-15-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2088-16-0x000000000043746E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

e464a2d9934812818fc4f5e410399ae3.exe

description pid process target process

PID 896 set thread context of 2088 896 e464a2d9934812818fc4f5e410399ae3.exe e464a2d9934812818fc4f5e410399ae3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2468 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e464a2d9934812818fc4f5e410399ae3.exe

pid process

2088 e464a2d9934812818fc4f5e410399ae3.exe
2088 e464a2d9934812818fc4f5e410399ae3.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e464a2d9934812818fc4f5e410399ae3.exee464a2d9934812818fc4f5e410399ae3.exe

description pid process

Token: SeDebugPrivilege 896 e464a2d9934812818fc4f5e410399ae3.exe
Token: SeDebugPrivilege 2088 e464a2d9934812818fc4f5e410399ae3.exe

description	pid	process	target process
PID 896 set thread context of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe

pid	process
2468	schtasks.exe

pid	process
2088	e464a2d9934812818fc4f5e410399ae3.exe
2088	e464a2d9934812818fc4f5e410399ae3.exe

description	pid	process
Token: SeDebugPrivilege	896	e464a2d9934812818fc4f5e410399ae3.exe
Token: SeDebugPrivilege	2088	e464a2d9934812818fc4f5e410399ae3.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

e464a2d9934812818fc4f5e410399ae3.exe

description	pid	process	target process
PID 896 wrote to memory of 2468	896	e464a2d9934812818fc4f5e410399ae3.exe	schtasks.exe
PID 896 wrote to memory of 2468	896	e464a2d9934812818fc4f5e410399ae3.exe	schtasks.exe
PID 896 wrote to memory of 2468	896	e464a2d9934812818fc4f5e410399ae3.exe	schtasks.exe
PID 896 wrote to memory of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe
PID 896 wrote to memory of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe
PID 896 wrote to memory of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe
PID 896 wrote to memory of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe
PID 896 wrote to memory of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe
PID 896 wrote to memory of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe
PID 896 wrote to memory of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe
PID 896 wrote to memory of 2088	896	e464a2d9934812818fc4f5e410399ae3.exe	e464a2d9934812818fc4f5e410399ae3.exe

C:\Users\Admin\AppData\Local\Temp\e464a2d9934812818fc4f5e410399ae3.exe
"C:\Users\Admin\AppData\Local\Temp\e464a2d9934812818fc4f5e410399ae3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oAxolApGetjL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D57.tmp"
2⤵
- Creates scheduled task(s)
PID:2468

C:\Users\Admin\AppData\Local\Temp\e464a2d9934812818fc4f5e410399ae3.exe
"C:\Users\Admin\AppData\Local\Temp\e464a2d9934812818fc4f5e410399ae3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e464a2d9934812818fc4f5e410399ae3.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8D57.tmp
MD5
531e96731338267398902ff1b610e501

SHA1
e4053f33ce9f00022f98e7b7882d89e8ae29315d

SHA256
0d79eaf4d3878b9038681a41cc9698cc6c6f7d4a7cfd001b8babf5801375ec45

SHA512
0d880347c9e70151ee68017fc9c3144b0604d01bf6df406f212d2a9bd61ddab92819ec7572fb1cdeb0a81a4139b32a1d004ee94527e3da53686e1058c0c8c594

Download Submit
memory/896-11-0x00000000081B0000-0x00000000081B3000-memory.dmp

Filesize
12KB

Download
memory/896-12-0x0000000006940000-0x000000000699D000-memory.dmp

Filesize
372KB

Download
memory/896-7-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/896-8-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/896-9-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/896-10-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/896-2-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/896-6-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/896-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/896-5-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/2088-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2088-16-0x000000000043746E-mapping.dmp

Download
memory/2088-18-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/2088-23-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/2468-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads