agenttesla | 682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe

Analysis

max time kernel
146s
max time network
124s
platform
windows10_x64
resource
win10v20210410
submitted
09/06/2021, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PURCHASE ORDER.exe
Size 835KB
Sample210609-wfd1gfvm9x
SHA256 682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe
MD5 6d06a8c0a9d0c0fb69187d7bdd4d4c03
SHA1 703e55f988e5608eaaf0e5e3d68e86134c0ad023
SHA512 095f5250fc5e31796e1cd58393bcfc3422802ea81ca6d170eb6f5496245a1821b1e27a508513ae2e953d175aea429a66ae9dc9bfc35db3803a23f728351bd823
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.viltroxs.com
Port
587
Username
[email protected]
Password
2muchBAR

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1236-144-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1236-148-0x00000000004375CE-mapping.dmp	family_agenttesla
behavioral2/memory/1236-169-0x0000000005720000-0x0000000005C1E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4448 set thread context of 1236	4448	PURCHASE ORDER.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4012	powershell.exe
4048	powershell.exe
4448	PURCHASE ORDER.exe
4448	PURCHASE ORDER.exe
4448	PURCHASE ORDER.exe
4448	PURCHASE ORDER.exe
4448	PURCHASE ORDER.exe
4448	PURCHASE ORDER.exe
4448	PURCHASE ORDER.exe
1236	PURCHASE ORDER.exe
1236	PURCHASE ORDER.exe
4048	powershell.exe
4012	powershell.exe
364	powershell.exe
4048	powershell.exe
364	powershell.exe
4012	powershell.exe
364	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeDebugPrivilege	4448	PURCHASE ORDER.exe
Token: SeDebugPrivilege	1236	PURCHASE ORDER.exe
Token: SeDebugPrivilege	364	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4012	4448	PURCHASE ORDER.exe	79
PID 4448 wrote to memory of 4012	4448	PURCHASE ORDER.exe	79
PID 4448 wrote to memory of 4012	4448	PURCHASE ORDER.exe	79
PID 4448 wrote to memory of 4048	4448	PURCHASE ORDER.exe	81
PID 4448 wrote to memory of 4048	4448	PURCHASE ORDER.exe	81
PID 4448 wrote to memory of 4048	4448	PURCHASE ORDER.exe	81
PID 4448 wrote to memory of 4220	4448	PURCHASE ORDER.exe	83
PID 4448 wrote to memory of 4220	4448	PURCHASE ORDER.exe	83
PID 4448 wrote to memory of 4220	4448	PURCHASE ORDER.exe	83
PID 4448 wrote to memory of 364	4448	PURCHASE ORDER.exe	85
PID 4448 wrote to memory of 364	4448	PURCHASE ORDER.exe	85
PID 4448 wrote to memory of 364	4448	PURCHASE ORDER.exe	85
PID 4448 wrote to memory of 400	4448	PURCHASE ORDER.exe	87
PID 4448 wrote to memory of 400	4448	PURCHASE ORDER.exe	87
PID 4448 wrote to memory of 400	4448	PURCHASE ORDER.exe	87
PID 4448 wrote to memory of 1032	4448	PURCHASE ORDER.exe	90
PID 4448 wrote to memory of 1032	4448	PURCHASE ORDER.exe	90
PID 4448 wrote to memory of 1032	4448	PURCHASE ORDER.exe	90
PID 4448 wrote to memory of 1136	4448	PURCHASE ORDER.exe	89
PID 4448 wrote to memory of 1136	4448	PURCHASE ORDER.exe	89
PID 4448 wrote to memory of 1136	4448	PURCHASE ORDER.exe	89
PID 4448 wrote to memory of 1236	4448	PURCHASE ORDER.exe	88
PID 4448 wrote to memory of 1236	4448	PURCHASE ORDER.exe	88
PID 4448 wrote to memory of 1236	4448	PURCHASE ORDER.exe	88
PID 4448 wrote to memory of 1236	4448	PURCHASE ORDER.exe	88
PID 4448 wrote to memory of 1236	4448	PURCHASE ORDER.exe	88
PID 4448 wrote to memory of 1236	4448	PURCHASE ORDER.exe	88
PID 4448 wrote to memory of 1236	4448	PURCHASE ORDER.exe	88
PID 4448 wrote to memory of 1236	4448	PURCHASE ORDER.exe	88

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iAQuqHs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iAQuqHs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF05C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iAQuqHs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  PID:400
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-197-0x0000000000D43000-0x0000000000D44000-memory.dmp

Download

memory/364-196-0x000000007EF40000-0x000000007EF41000-memory.dmp

Download

memory/364-172-0x0000000000D42000-0x0000000000D43000-memory.dmp

Download

memory/364-171-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/1236-169-0x0000000005720000-0x0000000005C1E000-memory.dmp

Download

memory/1236-144-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4012-143-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

memory/4012-131-0x0000000007710000-0x0000000007711000-memory.dmp

Download

memory/4012-195-0x0000000004CA3000-0x0000000004CA4000-memory.dmp

Download

memory/4012-194-0x000000007E640000-0x000000007E641000-memory.dmp

Download

memory/4012-130-0x00000000070A0000-0x00000000070A1000-memory.dmp

Download

memory/4012-147-0x0000000004CA2000-0x0000000004CA3000-memory.dmp

Download

memory/4048-161-0x0000000007C80000-0x0000000007C81000-memory.dmp

Download

memory/4048-193-0x0000000006963000-0x0000000006964000-memory.dmp

Download

memory/4048-146-0x0000000007930000-0x0000000007931000-memory.dmp

Download

memory/4048-137-0x0000000007600000-0x0000000007601000-memory.dmp

Download

memory/4048-141-0x0000000007780000-0x0000000007781000-memory.dmp

Download

memory/4048-150-0x0000000006960000-0x0000000006961000-memory.dmp

Download

memory/4048-140-0x00000000076A0000-0x00000000076A1000-memory.dmp

Download

memory/4048-151-0x0000000006962000-0x0000000006963000-memory.dmp

Download

memory/4048-163-0x00000000082B0000-0x00000000082B1000-memory.dmp

Download

memory/4048-168-0x00000000080B0000-0x00000000080B1000-memory.dmp

Download

memory/4048-192-0x000000007E770000-0x000000007E771000-memory.dmp

Download

memory/4048-191-0x0000000008E50000-0x0000000008E83000-memory.dmp

Download

memory/4448-121-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/4448-122-0x0000000005110000-0x000000000512E000-memory.dmp

Download

memory/4448-123-0x0000000006FD0000-0x000000000705D000-memory.dmp

Download

memory/4448-124-0x0000000006A40000-0x0000000006A8F000-memory.dmp

Download

memory/4448-114-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/4448-119-0x0000000004C30000-0x000000000512E000-memory.dmp

Download

memory/4448-120-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/4448-118-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download

memory/4448-117-0x0000000005130000-0x0000000005131000-memory.dmp

Download

memory/4448-116-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download