agenttesla | 94c45cc52e1fdbdf80a9d376ddbbd316a81d58acc1fa677a09b755e4cff17182

General

Target

po.exe
Size

898KB
MD5

83f6e4e71f9a6638f9caedb14934e3e6
SHA1

f7b05b5d187510060c810229155f290393fc3482
SHA256

94c45cc52e1fdbdf80a9d376ddbbd316a81d58acc1fa677a09b755e4cff17182
SHA512

134cfbb2aac318fde0323702cabc3270221b7870678e1f08a82513151c5fb0a984680cbc755f190c862385a25f4fbb1cfb4c9401ac344b4074e1429fe15145d2

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
business77.web-hosting.com
Port:
587
Username:
basari@makefoods-international.com
Password:
london1759

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1248-138-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1248-139-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral2/memory/1248-163-0x0000000005550000-0x0000000005A4E000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

po.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\toOnXvY = "C:\\Users\\Admin\\AppData\\Roaming\\toOnXvY\\toOnXvY.exe"	po.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

po.exe

description pid process target process

PID 4048 set thread context of 1248 4048 po.exe po.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1808 schtasks.exe

description	pid	process	target process
PID 4048 set thread context of 1248	4048	po.exe	po.exe

pid	process
1808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exepo.exepowershell.exe

pid	process
2388	powershell.exe
860	powershell.exe
1248	po.exe
1248	po.exe
1096	powershell.exe
2388	powershell.exe
860	powershell.exe
1096	powershell.exe
860	powershell.exe
2388	powershell.exe
1096	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepo.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	1248	po.exe
Token: SeDebugPrivilege	1096	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

po.exe

description	pid	process	target process
PID 4048 wrote to memory of 860	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 860	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 860	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 2388	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 2388	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 2388	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 1808	4048	po.exe	schtasks.exe
PID 4048 wrote to memory of 1808	4048	po.exe	schtasks.exe
PID 4048 wrote to memory of 1808	4048	po.exe	schtasks.exe
PID 4048 wrote to memory of 1096	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 1096	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 1096	4048	po.exe	powershell.exe
PID 4048 wrote to memory of 1248	4048	po.exe	po.exe
PID 4048 wrote to memory of 1248	4048	po.exe	po.exe
PID 4048 wrote to memory of 1248	4048	po.exe	po.exe
PID 4048 wrote to memory of 1248	4048	po.exe	po.exe
PID 4048 wrote to memory of 1248	4048	po.exe	po.exe
PID 4048 wrote to memory of 1248	4048	po.exe	po.exe
PID 4048 wrote to memory of 1248	4048	po.exe	po.exe
PID 4048 wrote to memory of 1248	4048	po.exe	po.exe

C:\Users\Admin\AppData\Local\Temp\po.exe
"C:\Users\Admin\AppData\Local\Temp\po.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\po.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wfclToY.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wfclToY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB585.tmp"
2⤵
- Creates scheduled task(s)
PID:1808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wfclToY.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Users\Admin\AppData\Local\Temp\po.exe
"C:\Users\Admin\AppData\Local\Temp\po.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
c2027718edf1305af77ec88f53facd67

SHA1
5041ad9992da5516cf20afec2a69157a2bdd5a04

SHA256
454ffa9d6c5f38f3259425e24ba928d3648c6b9e03ae79f0234f768ba6e90159

SHA512
48b79e0ccb6bec4ff0a113410a46d40e839cfc3fbb5dcd3216d09103affeac1c67f461a106d820238717f62bfea6802bda5db0bcb4770779645446547fbf7851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
681a453568585fe32cb7cd0557078750

SHA1
d5a595a086599b470be0d3f1e3d3ad0c44897589

SHA256
317ed6d6066606387a5000d280a9b3320e43d764fe1c60cff86ebb9614d175b6

SHA512
42325aa4b8b7a775f73ac166be2f5d6d9fb4edcf87eb4240e192cdbecd338ea0a86b5e2bde978ce2013c7e4315b128e3b3fee143e4bf029e0e9826f7863cca20

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB585.tmp
MD5
f4d34b345d611f1d55219eeb53aca446

SHA1
1c504f3f70df805f90e6380c9ba1517c781e8844

SHA256
30771c01dc87dbe9d538374cb52c466390a5f0cde478f3d2cdebfdd44268f67f

SHA512
5eb18954f25be7642b4bb9b8076ad54b070534593486fc05ce31d58c7ea630e41a0715fa5d35e8493197b4c5359d9164edc151dfb0b49f2562c0648d61ca696a

Download Submit
memory/860-167-0x00000000085F0000-0x00000000085F1000-memory.dmp

Filesize
4KB

Download
memory/860-171-0x0000000008990000-0x0000000008991000-memory.dmp

Filesize
4KB

Download
memory/860-196-0x0000000004D83000-0x0000000004D84000-memory.dmp

Filesize
4KB

Download
memory/860-192-0x000000007E6D0000-0x000000007E6D1000-memory.dmp

Filesize
4KB

Download
memory/860-191-0x00000000096C0000-0x00000000096F3000-memory.dmp

Filesize
204KB

Download
memory/860-169-0x0000000008610000-0x0000000008611000-memory.dmp

Filesize
4KB

Download
memory/860-125-0x0000000000000000-mapping.dmp

Download
memory/860-153-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/860-160-0x0000000004D82000-0x0000000004D83000-memory.dmp

Filesize
4KB

Download
memory/860-133-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/1096-166-0x0000000006662000-0x0000000006663000-memory.dmp

Filesize
4KB

Download
memory/1096-165-0x0000000006660000-0x0000000006661000-memory.dmp

Filesize
4KB

Download
memory/1096-137-0x0000000000000000-mapping.dmp

Download
memory/1096-151-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/1096-197-0x0000000006663000-0x0000000006664000-memory.dmp

Filesize
4KB

Download
memory/1096-156-0x0000000007480000-0x0000000007481000-memory.dmp

Filesize
4KB

Download
memory/1096-194-0x000000007F560000-0x000000007F561000-memory.dmp

Filesize
4KB

Download
memory/1248-139-0x00000000004374CE-mapping.dmp

Download
memory/1248-163-0x0000000005550000-0x0000000005A4E000-memory.dmp

Filesize
5.0MB

Download
memory/1248-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1808-129-0x0000000000000000-mapping.dmp

Download
memory/2388-135-0x0000000007910000-0x0000000007911000-memory.dmp

Filesize
4KB

Download
memory/2388-161-0x0000000008330000-0x0000000008331000-memory.dmp

Filesize
4KB

Download
memory/2388-148-0x00000000078E0000-0x00000000078E1000-memory.dmp

Filesize
4KB

Download
memory/2388-155-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/2388-159-0x0000000004E72000-0x0000000004E73000-memory.dmp

Filesize
4KB

Download
memory/2388-126-0x0000000000000000-mapping.dmp

Download
memory/2388-195-0x0000000004E73000-0x0000000004E74000-memory.dmp

Filesize
4KB

Download
memory/2388-193-0x000000007F8A0000-0x000000007F8A1000-memory.dmp

Filesize
4KB

Download
memory/4048-122-0x0000000005230000-0x0000000005234000-memory.dmp

Filesize
16KB

Download
memory/4048-123-0x00000000060F0000-0x00000000061B9000-memory.dmp

Filesize
804KB

Download
memory/4048-120-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/4048-124-0x0000000005750000-0x00000000057E0000-memory.dmp

Filesize
576KB

Download
memory/4048-117-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/4048-121-0x0000000005160000-0x00000000051FC000-memory.dmp

Filesize
624KB

Download
memory/4048-114-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/4048-118-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/4048-119-0x0000000002D00000-0x0000000002D01000-memory.dmp

Filesize
4KB

Download
memory/4048-116-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads