agenttesla | 9f6ac087249c3b9b13c176d96113a3123d6986b536aac8573c89cd478770ecc5

General

Target

SC_UNMSM 06042021.exe
Size

746KB
MD5

d861e9c1a56f528517dd530d4e7f001c
SHA1

ae07d2ec36e18775bc8c6347c73a3057d7ea7991
SHA256

9f6ac087249c3b9b13c176d96113a3123d6986b536aac8573c89cd478770ecc5
SHA512

ca279e8b178520a42cc9983f7db0e65162ac0acd69276f45663e32ae96b9426cc262073eee8adeffffd765ab3baf864893c5f07d4accf22015ed824f7396ecd4

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.chrismehat.com
Port:
587
Username:
market@chrismehat.com
Password:
vStcCO~Cyox6

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1000-144-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral2/memory/1000-142-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SC_UNMSM 06042021.exe

description pid process target process

PID 4704 set thread context of 1000 4704 SC_UNMSM 06042021.exe SC_UNMSM 06042021.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4028 schtasks.exe

description	pid	process	target process
PID 4704 set thread context of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe

pid	process
4028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

SC_UNMSM 06042021.exepowershell.exepowershell.exeSC_UNMSM 06042021.exepowershell.exe

pid	process
4704	SC_UNMSM 06042021.exe
4704	SC_UNMSM 06042021.exe
4704	SC_UNMSM 06042021.exe
4064	powershell.exe
2092	powershell.exe
4704	SC_UNMSM 06042021.exe
4704	SC_UNMSM 06042021.exe
4704	SC_UNMSM 06042021.exe
1000	SC_UNMSM 06042021.exe
1000	SC_UNMSM 06042021.exe
4064	powershell.exe
2092	powershell.exe
660	powershell.exe
660	powershell.exe
2092	powershell.exe
4064	powershell.exe
660	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

SC_UNMSM 06042021.exepowershell.exepowershell.exeSC_UNMSM 06042021.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4704	SC_UNMSM 06042021.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	1000	SC_UNMSM 06042021.exe
Token: SeDebugPrivilege	660	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

SC_UNMSM 06042021.exe

description	pid	process	target process
PID 4704 wrote to memory of 4064	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 4064	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 4064	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 2092	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 2092	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 2092	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 4028	4704	SC_UNMSM 06042021.exe	schtasks.exe
PID 4704 wrote to memory of 4028	4704	SC_UNMSM 06042021.exe	schtasks.exe
PID 4704 wrote to memory of 4028	4704	SC_UNMSM 06042021.exe	schtasks.exe
PID 4704 wrote to memory of 660	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 660	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 660	4704	SC_UNMSM 06042021.exe	powershell.exe
PID 4704 wrote to memory of 884	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 884	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 884	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe
PID 4704 wrote to memory of 1000	4704	SC_UNMSM 06042021.exe	SC_UNMSM 06042021.exe

C:\Users\Admin\AppData\Local\Temp\SC_UNMSM 06042021.exe
"C:\Users\Admin\AppData\Local\Temp\SC_UNMSM 06042021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SC_UNMSM 06042021.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VXnpYpHihzCqu.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VXnpYpHihzCqu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE437.tmp"
2⤵
- Creates scheduled task(s)
PID:4028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VXnpYpHihzCqu.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:660

C:\Users\Admin\AppData\Local\Temp\SC_UNMSM 06042021.exe
"C:\Users\Admin\AppData\Local\Temp\SC_UNMSM 06042021.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Users\Admin\AppData\Local\Temp\SC_UNMSM 06042021.exe
"C:\Users\Admin\AppData\Local\Temp\SC_UNMSM 06042021.exe"
2⤵
PID:884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
36fde69328c70660b35c371d6c0b109a

SHA1
782ccdca3f4b96c3524166014688cd6af706e4ee

SHA256
9d8464c9ee0fa7ba2b87334921fd23e58b8ff4788caee1dfad212c9eafe238e3

SHA512
ac361c2671fea2884059fbc6f24ff8303cdbfad9730df4b98ddc041d08b373d87ccb7701ef980ae3a00da38bb00047193ad216d9081d98ad75a83693aac66c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
02adf2f5446f0190067801c610510495

SHA1
b94cf9a73fc6716248407d332f47172c00bd50e7

SHA256
40cbdcdd1af004f1eca3fa150be14b4563b356ef82a86a62633f570e0271c953

SHA512
cd7eda1c14603bdbcfd2579e6fa635bcf29e5ac1826371c439f4aadb5e0b39e2ad58a6db22c2e8833fcead0a32184695e0a5feca087fa93bb0977f5bcc8ea6f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE437.tmp
MD5
8d1643c135a87e7df3d60070494d2140

SHA1
3ad0d29980ef49b862816fa8a74a45d5c2b2ef4e

SHA256
7018e4c0384612b1c97825db7a7bd2c0482f8b2684326d05dd53a1c935d0659c

SHA512
792ea53e61e81ee753c9ea19ae99e386aed5b37a8e9284c815a7fff05a1a63b3a53dfbd972ac1b997b95940386fcecae1008c9086d69325a946040abd40f1ff9

Download Submit
memory/660-162-0x0000000004142000-0x0000000004143000-memory.dmp

Filesize
4KB

Download
memory/660-198-0x0000000004143000-0x0000000004144000-memory.dmp

Filesize
4KB

Download
memory/660-138-0x0000000000000000-mapping.dmp

Download
memory/660-161-0x0000000004140000-0x0000000004141000-memory.dmp

Filesize
4KB

Download
memory/660-197-0x000000007F1A0000-0x000000007F1A1000-memory.dmp

Filesize
4KB

Download
memory/1000-142-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1000-144-0x00000000004375EE-mapping.dmp

Download
memory/1000-160-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/2092-126-0x0000000000000000-mapping.dmp

Download
memory/2092-159-0x0000000007402000-0x0000000007403000-memory.dmp

Filesize
4KB

Download
memory/2092-158-0x0000000007400000-0x0000000007401000-memory.dmp

Filesize
4KB

Download
memory/2092-194-0x000000007E5D0000-0x000000007E5D1000-memory.dmp

Filesize
4KB

Download
memory/2092-196-0x0000000007403000-0x0000000007404000-memory.dmp

Filesize
4KB

Download
memory/4028-127-0x0000000000000000-mapping.dmp

Download
memory/4064-125-0x0000000000000000-mapping.dmp

Download
memory/4064-169-0x0000000007DE0000-0x0000000007DE1000-memory.dmp

Filesize
4KB

Download
memory/4064-141-0x0000000007280000-0x0000000007281000-memory.dmp

Filesize
4KB

Download
memory/4064-140-0x0000000007210000-0x0000000007211000-memory.dmp

Filesize
4KB

Download
memory/4064-137-0x0000000007170000-0x0000000007171000-memory.dmp

Filesize
4KB

Download
memory/4064-156-0x00000000040F0000-0x00000000040F1000-memory.dmp

Filesize
4KB

Download
memory/4064-157-0x00000000040F2000-0x00000000040F3000-memory.dmp

Filesize
4KB

Download
memory/4064-133-0x0000000006B10000-0x0000000006B11000-memory.dmp

Filesize
4KB

Download
memory/4064-130-0x0000000004140000-0x0000000004141000-memory.dmp

Filesize
4KB

Download
memory/4064-195-0x00000000040F3000-0x00000000040F4000-memory.dmp

Filesize
4KB

Download
memory/4064-193-0x000000007E680000-0x000000007E681000-memory.dmp

Filesize
4KB

Download
memory/4064-189-0x0000000008BA0000-0x0000000008BD3000-memory.dmp

Filesize
204KB

Download
memory/4064-167-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/4064-143-0x0000000007550000-0x0000000007551000-memory.dmp

Filesize
4KB

Download
memory/4064-171-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Filesize
4KB

Download
memory/4704-123-0x0000000005DA0000-0x0000000005E25000-memory.dmp

Filesize
532KB

Download
memory/4704-122-0x000000007E2A0000-0x000000007E2A1000-memory.dmp

Filesize
4KB

Download
memory/4704-124-0x0000000001030000-0x0000000001079000-memory.dmp

Filesize
292KB

Download
memory/4704-114-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/4704-121-0x00000000053C0000-0x00000000053C4000-memory.dmp

Filesize
16KB

Download
memory/4704-120-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/4704-118-0x0000000004EE0000-0x00000000053DE000-memory.dmp

Filesize
5.0MB

Download
memory/4704-119-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/4704-117-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/4704-116-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads