agenttesla | 7f5b883a1d1915f1f333ac49b3ba6b99d6419a45a4bb2a53bae2e18013117a69

General

Target

SMCTC01352102260003,xlsl.exe

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.trakya.com.tr
Port:
587
Username:
trakya@trakya.com.tr
Password:
3mbK9Jjc5T

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/880-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/880-11-0x00000000004375FE-mapping.dmp	family_agenttesla
behavioral1/memory/880-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SMCTC01352102260003,xlsl.exe

description pid process target process

PID 744 set thread context of 880 744 SMCTC01352102260003,xlsl.exe SMCTC01352102260003,xlsl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

596 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SMCTC01352102260003,xlsl.exe

pid process

880 SMCTC01352102260003,xlsl.exe
880 SMCTC01352102260003,xlsl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SMCTC01352102260003,xlsl.exeSMCTC01352102260003,xlsl.exe

description pid process

Token: SeDebugPrivilege 744 SMCTC01352102260003,xlsl.exe
Token: SeDebugPrivilege 880 SMCTC01352102260003,xlsl.exe

description	pid	process	target process
PID 744 set thread context of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe

pid	process
596	schtasks.exe

pid	process
880	SMCTC01352102260003,xlsl.exe
880	SMCTC01352102260003,xlsl.exe

description	pid	process
Token: SeDebugPrivilege	744	SMCTC01352102260003,xlsl.exe
Token: SeDebugPrivilege	880	SMCTC01352102260003,xlsl.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

SMCTC01352102260003,xlsl.exe

description	pid	process	target process
PID 744 wrote to memory of 596	744	SMCTC01352102260003,xlsl.exe	schtasks.exe
PID 744 wrote to memory of 596	744	SMCTC01352102260003,xlsl.exe	schtasks.exe
PID 744 wrote to memory of 596	744	SMCTC01352102260003,xlsl.exe	schtasks.exe
PID 744 wrote to memory of 596	744	SMCTC01352102260003,xlsl.exe	schtasks.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe
PID 744 wrote to memory of 880	744	SMCTC01352102260003,xlsl.exe	SMCTC01352102260003,xlsl.exe

C:\Users\Admin\AppData\Local\Temp\SMCTC01352102260003,xlsl.exe
"C:\Users\Admin\AppData\Local\Temp\SMCTC01352102260003,xlsl.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FmevaTPlpKzIH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD568.tmp"
2⤵
- Creates scheduled task(s)
PID:596

C:\Users\Admin\AppData\Local\Temp\SMCTC01352102260003,xlsl.exe
"C:\Users\Admin\AppData\Local\Temp\SMCTC01352102260003,xlsl.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD568.tmp
MD5
01697a48abcf4da82373c7339e7e4f47

SHA1
04795d6b29b7994bf13dabde1c8d059d81be49c7

SHA256
cb7f5089f1346c010a5ee1ea2782b6b84c600cf6503934979ead56bc3dbad43d

SHA512
ded08c2d0490af3841acfdb31db6496c11ce362728fea6c150b64ead6d164dec8d282ef506849bbd7a935c5a985c8f9fcedb9b6f3fb6e88c04a815e254a6d34f

Download Submit
memory/596-8-0x0000000000000000-mapping.dmp

Download
memory/744-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/744-3-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/744-5-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/744-6-0x00000000002E0000-0x00000000002E3000-memory.dmp

Filesize
12KB

Download
memory/744-7-0x0000000004740000-0x000000000479C000-memory.dmp

Filesize
368KB

Download
memory/880-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/880-11-0x00000000004375FE-mapping.dmp

Download
memory/880-12-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/880-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/880-15-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads