agenttesla | 5d2ecd7210251e5d86670bd25655976536c0ac15f65185ea7003467be2ee5b19

General

Target

biggest.exe
Size

865KB
MD5

30bd38d2a90db3510019a3fe7dae45cd
SHA1

ac16719ecd9103689f42ee1719eb6f1b444dba4b
SHA256

5d2ecd7210251e5d86670bd25655976536c0ac15f65185ea7003467be2ee5b19
SHA512

a41ed21642beee783f844d7eac920d2edcab180def732afcbd5d021bf8a72c09a2fe33ab6da5980dabca3230c4a0e73af29ee883bfac2e94aac71cdbd595be84

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
prodip@precisionenergy.me
Password:
@Mexico1.,

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1524-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1524-68-0x00000000004375CE-mapping.dmp	family_agenttesla
behavioral1/memory/1524-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

biggest.exe

description pid process target process

PID 1268 set thread context of 1524 1268 biggest.exe biggest.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

524 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

biggest.exebiggest.exe

pid process

1268 biggest.exe
1524 biggest.exe
1524 biggest.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

biggest.exebiggest.exe

description pid process

Token: SeDebugPrivilege 1268 biggest.exe
Token: SeDebugPrivilege 1524 biggest.exe

description	pid	process	target process
PID 1268 set thread context of 1524	1268	biggest.exe	biggest.exe

pid	process
524	schtasks.exe

pid	process
1268	biggest.exe
1524	biggest.exe
1524	biggest.exe

description	pid	process
Token: SeDebugPrivilege	1268	biggest.exe
Token: SeDebugPrivilege	1524	biggest.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

biggest.exe

description	pid	process	target process
PID 1268 wrote to memory of 524	1268	biggest.exe	schtasks.exe
PID 1268 wrote to memory of 524	1268	biggest.exe	schtasks.exe
PID 1268 wrote to memory of 524	1268	biggest.exe	schtasks.exe
PID 1268 wrote to memory of 524	1268	biggest.exe	schtasks.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe
PID 1268 wrote to memory of 1524	1268	biggest.exe	biggest.exe

C:\Users\Admin\AppData\Local\Temp\biggest.exe
"C:\Users\Admin\AppData\Local\Temp\biggest.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDGbuSl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAAB.tmp"
2⤵
- Creates scheduled task(s)
PID:524

C:\Users\Admin\AppData\Local\Temp\biggest.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAAB.tmp
MD5
1fb2a4797ce879024d5730c8ecc46280

SHA1
9fead76d3fa71873dcfce51a1e873840bbda79bd

SHA256
96344b09af7598cf5d4ec230d4670a01f8dcc7bf85b64d335c5393b90a97a360

SHA512
4559c6a6f39dd46edc919d7c1ab1a9e8f0a284e77ee311943c2619f0d4a15cdc4abb5ed94337acddf00ae86da65f7fc84ce036ce25407e2bcabff4189c8e295e

Download Submit
memory/524-65-0x0000000000000000-mapping.dmp

Download
memory/1268-59-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1268-61-0x00000000071E0000-0x00000000071E1000-memory.dmp

Filesize
4KB

Download
memory/1268-62-0x0000000000560000-0x0000000000565000-memory.dmp

Filesize
20KB

Download
memory/1268-63-0x00000000081C0000-0x000000000826F000-memory.dmp

Filesize
700KB

Download
memory/1268-64-0x00000000083A0000-0x0000000008409000-memory.dmp

Filesize
420KB

Download
memory/1524-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-68-0x00000000004375CE-mapping.dmp

Download
memory/1524-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-71-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads