agenttesla | 06798301d113e18d6e6ffe3321628911d604bbc65ff5b465986155abd29f09dc

General

Target

53129cf39b6b180a20bef666da18f6ca.exe
Size

728KB
MD5

53129cf39b6b180a20bef666da18f6ca
SHA1

62487b332736b0a29584e625e43c6822e7c60422
SHA256

06798301d113e18d6e6ffe3321628911d604bbc65ff5b465986155abd29f09dc
SHA512

3fc006f01cf7a179db4519d4b67e5be4edb5d92ca98cbf5545a9f399849018ffb83f0749ef8bb3dbb46b4eb1d481ecf7ec8c4ee5700b6f812527717949f3b8f0

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
accounts@trialseqco-uk.icu
Password:
NewMexcico@123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/664-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/664-69-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral1/memory/664-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

53129cf39b6b180a20bef666da18f6ca.exe

description pid process target process

PID 1820 set thread context of 664 1820 53129cf39b6b180a20bef666da18f6ca.exe 53129cf39b6b180a20bef666da18f6ca.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

684 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

53129cf39b6b180a20bef666da18f6ca.exe

pid process

664 53129cf39b6b180a20bef666da18f6ca.exe
664 53129cf39b6b180a20bef666da18f6ca.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

53129cf39b6b180a20bef666da18f6ca.exe

description pid process

Token: SeDebugPrivilege 664 53129cf39b6b180a20bef666da18f6ca.exe

description	pid	process	target process
PID 1820 set thread context of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe

pid	process
684	schtasks.exe

pid	process
664	53129cf39b6b180a20bef666da18f6ca.exe
664	53129cf39b6b180a20bef666da18f6ca.exe

description	pid	process
Token: SeDebugPrivilege	664	53129cf39b6b180a20bef666da18f6ca.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

53129cf39b6b180a20bef666da18f6ca.exe

description	pid	process	target process
PID 1820 wrote to memory of 684	1820	53129cf39b6b180a20bef666da18f6ca.exe	schtasks.exe
PID 1820 wrote to memory of 684	1820	53129cf39b6b180a20bef666da18f6ca.exe	schtasks.exe
PID 1820 wrote to memory of 684	1820	53129cf39b6b180a20bef666da18f6ca.exe	schtasks.exe
PID 1820 wrote to memory of 684	1820	53129cf39b6b180a20bef666da18f6ca.exe	schtasks.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe
PID 1820 wrote to memory of 664	1820	53129cf39b6b180a20bef666da18f6ca.exe	53129cf39b6b180a20bef666da18f6ca.exe

C:\Users\Admin\AppData\Local\Temp\53129cf39b6b180a20bef666da18f6ca.exe
"C:\Users\Admin\AppData\Local\Temp\53129cf39b6b180a20bef666da18f6ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mJKQTPgr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp32C.tmp"
2⤵
- Creates scheduled task(s)
PID:684

C:\Users\Admin\AppData\Local\Temp\53129cf39b6b180a20bef666da18f6ca.exe
"C:\Users\Admin\AppData\Local\Temp\53129cf39b6b180a20bef666da18f6ca.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:664

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp32C.tmp
MD5
53518a963003c5c98afcaca42562d54e

SHA1
8482e1a50215e32a73a6102a4978610a0ba3c0ec

SHA256
0b4c390c584992cfec17f1b947c0e1e362c32bd6f34bd3375f99c045ff4274d7

SHA512
68035cb62bc5cedf8a1347120a1032f0f90b1c8621609830868666a0c56c769c9f6d043ddba0227c7fb33168c74a98af699e7d37055b09bbadbcc3c3889f88e9

Download Submit
memory/664-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/664-69-0x000000000043761E-mapping.dmp

Download
memory/664-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/664-72-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/684-66-0x0000000000000000-mapping.dmp

Download
memory/1820-59-0x0000000001350000-0x0000000001351000-memory.dmp

Filesize
4KB

Download
memory/1820-61-0x0000000000FC0000-0x0000000001071000-memory.dmp

Filesize
708KB

Download
memory/1820-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1820-63-0x00000000003C0000-0x00000000003DB000-memory.dmp

Filesize
108KB

Download
memory/1820-64-0x00000000051F0000-0x000000000526B000-memory.dmp

Filesize
492KB

Download
memory/1820-65-0x0000000000B20000-0x0000000000B5D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads