agenttesla | 2bab90115e107a01e2382c39f56afb09b4dcf0e788270d34867b83c872286295

General

Target

OC_UNMSM 5904263.exe
Size

805KB
MD5

47ae34010e760d2a6d5487710e21db4d
SHA1

30c5995c0cd40ad5102953bef4e591bed55749b7
SHA256

2bab90115e107a01e2382c39f56afb09b4dcf0e788270d34867b83c872286295
SHA512

141687376bcc04744ba66c72cf0e1bc33a1db1550b3c10157f7d1dbc4db6168d9f85576f129d8f5b448ef6d6341bee3b5bea2de9e262c152e9a82771c1bb3eaa

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.chrismehat.com
Port:
587
Username:
market@chrismehat.com
Password:
vStcCO~Cyox6

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2872-144-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2872-145-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral2/memory/2872-155-0x0000000005790000-0x0000000005C8E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

OC_UNMSM 5904263.exe

description pid process target process

PID 1176 set thread context of 2872 1176 OC_UNMSM 5904263.exe OC_UNMSM 5904263.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4056 schtasks.exe

description	pid	process	target process
PID 1176 set thread context of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe

pid	process
4056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

OC_UNMSM 5904263.exepowershell.exepowershell.exeOC_UNMSM 5904263.exepowershell.exe

pid	process
1176	OC_UNMSM 5904263.exe
1176	OC_UNMSM 5904263.exe
1176	OC_UNMSM 5904263.exe
1404	powershell.exe
3224	powershell.exe
1176	OC_UNMSM 5904263.exe
2872	OC_UNMSM 5904263.exe
2872	OC_UNMSM 5904263.exe
1404	powershell.exe
3224	powershell.exe
2176	powershell.exe
2176	powershell.exe
1404	powershell.exe
3224	powershell.exe
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

OC_UNMSM 5904263.exepowershell.exepowershell.exeOC_UNMSM 5904263.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1176	OC_UNMSM 5904263.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	2872	OC_UNMSM 5904263.exe
Token: SeDebugPrivilege	2176	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

OC_UNMSM 5904263.exe

description	pid	process	target process
PID 1176 wrote to memory of 1404	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 1404	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 1404	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 3224	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 3224	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 3224	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 4056	1176	OC_UNMSM 5904263.exe	schtasks.exe
PID 1176 wrote to memory of 4056	1176	OC_UNMSM 5904263.exe	schtasks.exe
PID 1176 wrote to memory of 4056	1176	OC_UNMSM 5904263.exe	schtasks.exe
PID 1176 wrote to memory of 2176	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 2176	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 2176	1176	OC_UNMSM 5904263.exe	powershell.exe
PID 1176 wrote to memory of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe
PID 1176 wrote to memory of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe
PID 1176 wrote to memory of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe
PID 1176 wrote to memory of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe
PID 1176 wrote to memory of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe
PID 1176 wrote to memory of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe
PID 1176 wrote to memory of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe
PID 1176 wrote to memory of 2872	1176	OC_UNMSM 5904263.exe	OC_UNMSM 5904263.exe

C:\Users\Admin\AppData\Local\Temp\OC_UNMSM 5904263.exe
"C:\Users\Admin\AppData\Local\Temp\OC_UNMSM 5904263.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\OC_UNMSM 5904263.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kSeekA.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kSeekA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp178B.tmp"
2⤵
- Creates scheduled task(s)
PID:4056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kSeekA.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Users\Admin\AppData\Local\Temp\OC_UNMSM 5904263.exe
"C:\Users\Admin\AppData\Local\Temp\OC_UNMSM 5904263.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
ebd8b03051b7b0f3a000fb7ccfedac30

SHA1
4b2e81149e38d120589231f4c030b89a07e6ab77

SHA256
b1f40809e54a573dc84d1203fd03c57235f0e8177a37a020ad871f62bcaccbdf

SHA512
bbb4f8c3a4a4bbf131eeb75b4d3ac5b218ace05be4fc3fa309e850c412608667a0d8a009000217cf84710192d47f44b841ddd0c938019131542560c793f373c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
57c1b2e706cb2ba6bb8e3dc10249aa8e

SHA1
1bc29d9060d991538972b87bf8b44fb25ecb065c

SHA256
fcb9bde69e44b9637ba88b9cad4ed8dbf259c06aaa24107454fef37e75a80c76

SHA512
525e252ae03280c7fb673ae3ecbd78a941b18588b23a01943ba0a013ba56d6ef986583c09b4e81d6c8b1210c4df1831ee42ce66f4e2d302ee0ba342ff0f143fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp178B.tmp
MD5
9f53af0d4da44aaca14b69a03a61f1fc

SHA1
ef6f225b7588f579bb222972275a67aba4161ba1

SHA256
118cefc6bd4bc2cf91bc30803589d66add2d6e570edac07fa64452396db32417

SHA512
276b956ebbf6bfd0621e53954c2823cbdfd1817c4dd87a8cf4cc70df3c0b11e109c9d1c7ef0494a4fb1a61d14c926f1b49fe1c5a2996062bf817cbfd7f38067b

Download Submit
memory/1176-121-0x0000000007000000-0x0000000007004000-memory.dmp

Filesize
16KB

Download
memory/1176-120-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/1176-119-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/1176-123-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1176-122-0x0000000004980000-0x0000000004A1C000-memory.dmp

Filesize
624KB

Download
memory/1176-124-0x00000000067A0000-0x000000000684A000-memory.dmp

Filesize
680KB

Download
memory/1176-125-0x0000000006950000-0x00000000069CB000-memory.dmp

Filesize
492KB

Download
memory/1176-118-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/1176-117-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/1176-116-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1176-114-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1404-163-0x0000000007AE0000-0x0000000007AE1000-memory.dmp

Filesize
4KB

Download
memory/1404-141-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

Filesize
4KB

Download
memory/1404-132-0x0000000007220000-0x0000000007221000-memory.dmp

Filesize
4KB

Download
memory/1404-139-0x0000000007900000-0x0000000007901000-memory.dmp

Filesize
4KB

Download
memory/1404-140-0x0000000007970000-0x0000000007971000-memory.dmp

Filesize
4KB

Download
memory/1404-194-0x000000007F030000-0x000000007F031000-memory.dmp

Filesize
4KB

Download
memory/1404-195-0x0000000006BE3000-0x0000000006BE4000-memory.dmp

Filesize
4KB

Download
memory/1404-131-0x0000000006B30000-0x0000000006B31000-memory.dmp

Filesize
4KB

Download
memory/1404-172-0x00000000082B0000-0x00000000082B1000-memory.dmp

Filesize
4KB

Download
memory/1404-150-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

Filesize
4KB

Download
memory/1404-153-0x0000000006BE2000-0x0000000006BE3000-memory.dmp

Filesize
4KB

Download
memory/1404-165-0x0000000008340000-0x0000000008341000-memory.dmp

Filesize
4KB

Download
memory/1404-126-0x0000000000000000-mapping.dmp

Download
memory/1404-138-0x0000000007120000-0x0000000007121000-memory.dmp

Filesize
4KB

Download
memory/2176-142-0x0000000000000000-mapping.dmp

Download
memory/2176-161-0x0000000004460000-0x0000000004461000-memory.dmp

Filesize
4KB

Download
memory/2176-171-0x0000000004462000-0x0000000004463000-memory.dmp

Filesize
4KB

Download
memory/2176-197-0x000000007E590000-0x000000007E591000-memory.dmp

Filesize
4KB

Download
memory/2176-198-0x0000000004463000-0x0000000004464000-memory.dmp

Filesize
4KB

Download
memory/2872-155-0x0000000005790000-0x0000000005C8E000-memory.dmp

Filesize
5.0MB

Download
memory/2872-145-0x00000000004375EE-mapping.dmp

Download
memory/2872-144-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3224-159-0x0000000004CA2000-0x0000000004CA3000-memory.dmp

Filesize
4KB

Download
memory/3224-196-0x0000000004CA3000-0x0000000004CA4000-memory.dmp

Filesize
4KB

Download
memory/3224-193-0x000000007EE40000-0x000000007EE41000-memory.dmp

Filesize
4KB

Download
memory/3224-127-0x0000000000000000-mapping.dmp

Download
memory/3224-157-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/4056-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads