agenttesla | 67e40f25962f1a77b84cc4a4b990bf99041924736e11b55e74edef29816ef3ec

General

Target

CT_7093164285.exe
Size

852KB
MD5

4115754d5b0d6ab49aed7fdde034d04a
SHA1

6eb5fbd8c35001249521652c36c0cb9feccddbbe
SHA256

67e40f25962f1a77b84cc4a4b990bf99041924736e11b55e74edef29816ef3ec
SHA512

27b8c0c266d8836499c3e1c4496569cd23364f925933708e1ced61ed682eae1733919c6e09e4e2f0dcd1e2d5bd76a8843f1b0b6b89a95ae779d04cfd1c00a012

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.chrismehat.com
Port:
587
Username:
market@chrismehat.com
Password:
vStcCO~Cyox6

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2324-143-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2324-144-0x00000000004375EE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

CT_7093164285.exe

description pid process target process

PID 4808 set thread context of 2324 4808 CT_7093164285.exe CT_7093164285.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1188 schtasks.exe

description	pid	process	target process
PID 4808 set thread context of 2324	4808	CT_7093164285.exe	CT_7093164285.exe

pid	process
1188	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

CT_7093164285.exepowershell.exepowershell.exeCT_7093164285.exepowershell.exe

pid	process
4808	CT_7093164285.exe
4808	CT_7093164285.exe
4808	CT_7093164285.exe
4808	CT_7093164285.exe
936	powershell.exe
652	powershell.exe
2324	CT_7093164285.exe
2324	CT_7093164285.exe
652	powershell.exe
2100	powershell.exe
936	powershell.exe
2100	powershell.exe
936	powershell.exe
652	powershell.exe
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

CT_7093164285.exepowershell.exepowershell.exeCT_7093164285.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4808	CT_7093164285.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	2324	CT_7093164285.exe
Token: SeDebugPrivilege	2100	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

CT_7093164285.exe

description	pid	process	target process
PID 4808 wrote to memory of 936	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 936	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 936	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 652	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 652	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 652	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 1188	4808	CT_7093164285.exe	schtasks.exe
PID 4808 wrote to memory of 1188	4808	CT_7093164285.exe	schtasks.exe
PID 4808 wrote to memory of 1188	4808	CT_7093164285.exe	schtasks.exe
PID 4808 wrote to memory of 2100	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 2100	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 2100	4808	CT_7093164285.exe	powershell.exe
PID 4808 wrote to memory of 2324	4808	CT_7093164285.exe	CT_7093164285.exe
PID 4808 wrote to memory of 2324	4808	CT_7093164285.exe	CT_7093164285.exe
PID 4808 wrote to memory of 2324	4808	CT_7093164285.exe	CT_7093164285.exe
PID 4808 wrote to memory of 2324	4808	CT_7093164285.exe	CT_7093164285.exe
PID 4808 wrote to memory of 2324	4808	CT_7093164285.exe	CT_7093164285.exe
PID 4808 wrote to memory of 2324	4808	CT_7093164285.exe	CT_7093164285.exe
PID 4808 wrote to memory of 2324	4808	CT_7093164285.exe	CT_7093164285.exe
PID 4808 wrote to memory of 2324	4808	CT_7093164285.exe	CT_7093164285.exe

C:\Users\Admin\AppData\Local\Temp\CT_7093164285.exe
"C:\Users\Admin\AppData\Local\Temp\CT_7093164285.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\CT_7093164285.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tntLxlzrbE.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tntLxlzrbE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D86.tmp"
2⤵
- Creates scheduled task(s)
PID:1188

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tntLxlzrbE.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Users\Admin\AppData\Local\Temp\CT_7093164285.exe
"C:\Users\Admin\AppData\Local\Temp\CT_7093164285.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
99cd84af19642f8f117f2ffebc780b42

SHA1
d774d1f3a4275f0ba81c77ea655b68aaa73b6a89

SHA256
4e4dfe3948d4dcb920d833c0113559eda8e9fe9cc6e513fad7b592b7c3b00034

SHA512
138ebc06e1e49ef44878ad351631e2d478d7f0fc09b580e6212ec647f3f072118d2e512fe38314c2b4e26468e031ab0e360a13b151784dadd150c3204b117e8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
5cfbf3a302702ea74a80f2709464a936

SHA1
a5741bcd919c7874692919b55d2a51389ff73b9d

SHA256
e7dd4e4c02ad181e0339cd55155efdc1b903a0e160ce3d4ef3f434bc4f5436ad

SHA512
3a7eaf633811af10f3a750028e0f3a6e086c3c44c57c7af5085d2d4b2f275cda11f72eafe484bbd9a8195209f1b7575f94493563f5544d38a512ddf35355c71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1D86.tmp
MD5
ca9f51abc424f21297d9fc55f33871cc

SHA1
a89e6bfabadc07b2cf18638bffd9d50c3c7c3f60

SHA256
393b41702bc236a3a214c0146c17aa97c33425fa7cbd54cfffb15cc2de0915b5

SHA512
7761e69a16a0f97c27bc8b89816bc961778a9b11c97b007d945e63de6f24ba2ea248bd37d9707ca61a24dd58d5a07348aa9451388c70d341368caf15e6211104

Download Submit
memory/652-165-0x0000000007DF0000-0x0000000007DF1000-memory.dmp

Filesize
4KB

Download
memory/652-193-0x000000007F260000-0x000000007F261000-memory.dmp

Filesize
4KB

Download
memory/652-192-0x0000000009090000-0x00000000090C3000-memory.dmp

Filesize
204KB

Download
memory/652-167-0x00000000082F0000-0x00000000082F1000-memory.dmp

Filesize
4KB

Download
memory/652-139-0x0000000001190000-0x0000000001191000-memory.dmp

Filesize
4KB

Download
memory/652-158-0x0000000007A20000-0x0000000007A21000-memory.dmp

Filesize
4KB

Download
memory/652-152-0x0000000007910000-0x0000000007911000-memory.dmp

Filesize
4KB

Download
memory/652-154-0x00000000070E0000-0x00000000070E1000-memory.dmp

Filesize
4KB

Download
memory/652-127-0x0000000000000000-mapping.dmp

Download
memory/652-147-0x0000000006F40000-0x0000000006F41000-memory.dmp

Filesize
4KB

Download
memory/652-140-0x0000000001192000-0x0000000001193000-memory.dmp

Filesize
4KB

Download
memory/652-197-0x0000000001193000-0x0000000001194000-memory.dmp

Filesize
4KB

Download
memory/652-136-0x00000000071E0000-0x00000000071E1000-memory.dmp

Filesize
4KB

Download
memory/936-173-0x00000000088D0000-0x00000000088D1000-memory.dmp

Filesize
4KB

Download
memory/936-126-0x0000000000000000-mapping.dmp

Download
memory/936-141-0x0000000003542000-0x0000000003543000-memory.dmp

Filesize
4KB

Download
memory/936-134-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/936-196-0x0000000003543000-0x0000000003544000-memory.dmp

Filesize
4KB

Download
memory/936-194-0x000000007E660000-0x000000007E661000-memory.dmp

Filesize
4KB

Download
memory/936-138-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/1188-128-0x0000000000000000-mapping.dmp

Download
memory/2100-170-0x0000000006F70000-0x0000000006F71000-memory.dmp

Filesize
4KB

Download
memory/2100-171-0x0000000006F72000-0x0000000006F73000-memory.dmp

Filesize
4KB

Download
memory/2100-198-0x0000000006F73000-0x0000000006F74000-memory.dmp

Filesize
4KB

Download
memory/2100-142-0x0000000000000000-mapping.dmp

Download
memory/2100-195-0x000000007E500000-0x000000007E501000-memory.dmp

Filesize
4KB

Download
memory/2324-144-0x00000000004375EE-mapping.dmp

Download
memory/2324-143-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2324-169-0x00000000050B0000-0x00000000055AE000-memory.dmp

Filesize
5.0MB

Download
memory/4808-120-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/4808-121-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/4808-114-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4808-122-0x0000000005F30000-0x0000000005F34000-memory.dmp

Filesize
16KB

Download
memory/4808-125-0x00000000086B0000-0x0000000008711000-memory.dmp

Filesize
388KB

Download
memory/4808-123-0x000000007EC90000-0x000000007EC91000-memory.dmp

Filesize
4KB

Download
memory/4808-119-0x0000000005300000-0x00000000057FE000-memory.dmp

Filesize
5.0MB

Download
memory/4808-124-0x00000000011D0000-0x0000000001269000-memory.dmp

Filesize
612KB

Download
memory/4808-118-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/4808-117-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/4808-116-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads