agenttesla | c7319977ff8a2bd8f45d60081360ec87bcef2cfc191bda718ecf9b787e44593a

General

Target

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
Size

780KB
MD5

eec8e09341c18d8797208118bd387900
SHA1

ba1a47be8b33a404415a71c0ccb11ddeee4c06a0
SHA256

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d
SHA512

d786699d15b6178c1e168126b30f4fb16d76ea65e3370bb619bb9e1cc9f13d391dda4b818f837a2171c69ac82a3186485e12c4ec7758fe075ac36dd172c65934

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.slimecheck.com
Port:
587
Username:
info@slimecheck.com
Password:
abc00000

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1292-126-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1292-127-0x00000000004375CE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\DQONrNe = "C:\\Users\\Admin\\AppData\\Roaming\\DQONrNe\\DQONrNe.exe"	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

description	pid	process	target process
PID 584 set thread context of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4000 schtasks.exe

pid	process
4000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

pid	process
1292	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
1292	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

pid process

1292 485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

description pid process

Token: SeDebugPrivilege 1292 485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

pid process

1292 485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

description	pid	process
Token: SeDebugPrivilege	1292	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

description	pid	process	target process
PID 584 wrote to memory of 4000	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	schtasks.exe
PID 584 wrote to memory of 4000	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	schtasks.exe
PID 584 wrote to memory of 4000	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	schtasks.exe
PID 584 wrote to memory of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
PID 584 wrote to memory of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
PID 584 wrote to memory of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
PID 584 wrote to memory of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
PID 584 wrote to memory of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
PID 584 wrote to memory of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
PID 584 wrote to memory of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
PID 584 wrote to memory of 1292	584	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe	485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe

C:\Users\Admin\AppData\Local\Temp\485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
"C:\Users\Admin\AppData\Local\Temp\485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabZTym" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2A5.tmp"
2⤵
- Creates scheduled task(s)
PID:4000

C:\Users\Admin\AppData\Local\Temp\485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe
"{path}"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\485356515d560799c8f9e159e436cbbb85110fcb3b5dc2180520186d0a406e9d.bin.exe.log
MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE2A5.tmp
MD5
2456b9d3d2b028d65e778d4ece966851

SHA1
a2a60e6d7fca51796922f29b150a666c0c7be4c4

SHA256
e347aecc893e63d884f437888a99a5964ba11111940318b7aa564c57d6e5bcec

SHA512
13574bc420b241c0b25051fdf1e5d9aac26542e20fd11abd6591b1116f6e5190439419a1c7bd3e4c0eeb873f3f33942e95e903289ddc59ecb6cc288990c6c1b6

Download Submit
memory/584-123-0x00000000096E0000-0x0000000009766000-memory.dmp

Filesize
536KB

Download
memory/584-118-0x0000000004A90000-0x0000000004F8E000-memory.dmp

Filesize
5.0MB

Download
memory/584-119-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/584-120-0x0000000006E90000-0x0000000006E91000-memory.dmp

Filesize
4KB

Download
memory/584-121-0x0000000004C60000-0x0000000004C6E000-memory.dmp

Filesize
56KB

Download
memory/584-122-0x0000000007010000-0x00000000070D6000-memory.dmp

Filesize
792KB

Download
memory/584-114-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/584-116-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/584-117-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/1292-127-0x00000000004375CE-mapping.dmp

Download
memory/1292-126-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1292-133-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/1292-134-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/1292-135-0x0000000005EE0000-0x0000000005EE1000-memory.dmp

Filesize
4KB

Download
memory/1292-138-0x0000000005351000-0x0000000005352000-memory.dmp

Filesize
4KB

Download
memory/4000-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads