agenttesla | 5a8ea261a8f88443529553058026027054b62c7dc2969632de08212db8293e27

General

Target

Project Enquiry - KHI To LSG.exe
Size

853KB
MD5

c895410694b7aaed3c3495536c240a93
SHA1

3abe57e1d7073caf1711dbc4bd82df7379f47211
SHA256

5a8ea261a8f88443529553058026027054b62c7dc2969632de08212db8293e27
SHA512

9fb79b5301ef47f5389cc5a08de07fd26f383d77d3d1578f3de7dfaebdd19a586360c006c9cdbd86efb60a38c7e0fc39548cd39a8e96cde6110a76ec53f5a9cb

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1855581212:AAGSsAgiKOAKCEx8_hulz-BQit55_qDVNsM/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1300-127-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1300-128-0x000000000043774E-mapping.dmp	family_agenttesla
behavioral2/memory/1300-134-0x0000000005720000-0x0000000005C1E000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Project Enquiry - KHI To LSG.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\NewApp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NewApp\\NewApp.exe"	Project Enquiry - KHI To LSG.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Project Enquiry - KHI To LSG.exe

description pid process target process

PID 3680 set thread context of 1300 3680 Project Enquiry - KHI To LSG.exe Project Enquiry - KHI To LSG.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3616 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Project Enquiry - KHI To LSG.exe

pid process

1300 Project Enquiry - KHI To LSG.exe
1300 Project Enquiry - KHI To LSG.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Project Enquiry - KHI To LSG.exe

description pid process

Token: SeDebugPrivilege 1300 Project Enquiry - KHI To LSG.exe

description	pid	process	target process
PID 3680 set thread context of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe

pid	process
3616	schtasks.exe

pid	process
1300	Project Enquiry - KHI To LSG.exe
1300	Project Enquiry - KHI To LSG.exe

description	pid	process
Token: SeDebugPrivilege	1300	Project Enquiry - KHI To LSG.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Project Enquiry - KHI To LSG.exe

description	pid	process	target process
PID 3680 wrote to memory of 3616	3680	Project Enquiry - KHI To LSG.exe	schtasks.exe
PID 3680 wrote to memory of 3616	3680	Project Enquiry - KHI To LSG.exe	schtasks.exe
PID 3680 wrote to memory of 3616	3680	Project Enquiry - KHI To LSG.exe	schtasks.exe
PID 3680 wrote to memory of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe
PID 3680 wrote to memory of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe
PID 3680 wrote to memory of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe
PID 3680 wrote to memory of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe
PID 3680 wrote to memory of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe
PID 3680 wrote to memory of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe
PID 3680 wrote to memory of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe
PID 3680 wrote to memory of 1300	3680	Project Enquiry - KHI To LSG.exe	Project Enquiry - KHI To LSG.exe

C:\Users\Admin\AppData\Local\Temp\Project Enquiry - KHI To LSG.exe
"C:\Users\Admin\AppData\Local\Temp\Project Enquiry - KHI To LSG.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gzrJtoA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFCA1.tmp"
2⤵
- Creates scheduled task(s)
PID:3616

C:\Users\Admin\AppData\Local\Temp\Project Enquiry - KHI To LSG.exe
"C:\Users\Admin\AppData\Local\Temp\Project Enquiry - KHI To LSG.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Project Enquiry - KHI To LSG.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFCA1.tmp
MD5
480b535ba0ee9af2c1d0d16817c474f7

SHA1
b1a6ef701f5cbcc9e6b444a88e0369a304f44f0c

SHA256
0fe78d0a8b5b74b8106fab21fc2bcee8d7715c4ac40c997d211f17265aeb56ce

SHA512
73e5bbdc9cb4ddff01b8fda7c15fe287591906557dd233226b193d77f7447dbd8bea36f53f1bc7b05d5e820032b137e72864300cf60e33659b2469b96344b9af

Download Submit
memory/1300-136-0x0000000006390000-0x0000000006391000-memory.dmp

Filesize
4KB

Download
memory/1300-135-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/1300-134-0x0000000005720000-0x0000000005C1E000-memory.dmp

Filesize
5.0MB

Download
memory/1300-128-0x000000000043774E-mapping.dmp

Download
memory/1300-127-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3616-125-0x0000000000000000-mapping.dmp

Download
memory/3680-119-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/3680-124-0x00000000088A0000-0x000000000892A000-memory.dmp

Filesize
552KB

Download
memory/3680-123-0x0000000006320000-0x00000000063DD000-memory.dmp

Filesize
756KB

Download
memory/3680-122-0x00000000056C0000-0x00000000056C4000-memory.dmp

Filesize
16KB

Download
memory/3680-121-0x00000000053E0000-0x000000000547C000-memory.dmp

Filesize
624KB

Download
memory/3680-120-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/3680-114-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/3680-118-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/3680-117-0x0000000005A20000-0x0000000005A21000-memory.dmp

Filesize
4KB

Download
memory/3680-116-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads