agenttesla | b53452ceb042eda660c8caf32d410df482b58ef7818bcd013036f54ef4c3be84

General

Target
SOA.exe
Size 580KB
Sample210319-ff7m3pl2n2
SHA256 b53452ceb042eda660c8caf32d410df482b58ef7818bcd013036f54ef4c3be84
MD5 feb990f2eb7a1b9abbbe4a78ff1687f2
SHA1 6fcf283702bea9b0ba8d0ea25df9540af4c24f23
SHA512 502921b66d71b64f56b0845f6174269270e23d2a82666cdac574933d3431405d24a050c7a5de8cd5334808b4443dbd73e9c05c35bb220220b9103480c7b664e0
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.vivaldi.net
Port
587
Username
[email protected]
Password
Qwerty2020Hp##

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral1/memory/580-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/580-8-0x00000000004374CE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 548 set thread context of 580	548	SOA.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
580	SOA.exe
580	SOA.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	SOA.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 432	548	SOA.exe	29
PID 548 wrote to memory of 432	548	SOA.exe	29
PID 548 wrote to memory of 432	548	SOA.exe	29
PID 548 wrote to memory of 432	548	SOA.exe	29
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 548 wrote to memory of 580	548	SOA.exe	31
PID 580 wrote to memory of 972	580	SOA.exe	32
PID 580 wrote to memory of 972	580	SOA.exe	32
PID 580 wrote to memory of 972	580	SOA.exe	32
PID 580 wrote to memory of 972	580	SOA.exe	32

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AbqLifxXCotQXs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDF47.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:432
- C:\Users\Admin\AppData\Local\Temp\SOA.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 520
    3⤵
    PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-2-0x0000000076451000-0x0000000076453000-memory.dmp

Download

memory/548-3-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/548-4-0x0000000000321000-0x0000000000322000-memory.dmp

Download

memory/580-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/580-10-0x0000000000590000-0x0000000000591000-memory.dmp

Download

memory/972-12-0x0000000001DE0000-0x0000000001DF1000-memory.dmp

Download

memory/972-16-0x0000000001E70000-0x0000000001E71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads