agenttesla | b47c11b0e48a16e4e1d861dcb524bf3bcabfe1481853b7d94fb738f635d1d5aa

General

Target

#$$$!1weF5(1).exe
Size

662KB
MD5

65c520abdacd8aacdb7f93ed7b00d716
SHA1

c5ca68ab7ce2e46e0b924acb0365af5f4935847d
SHA256

b47c11b0e48a16e4e1d861dcb524bf3bcabfe1481853b7d94fb738f635d1d5aa
SHA512

f369b973656103610c08a054ae50a3ddcccc9aa64acfc9fec9d6e06b5f6cd3d5e3ca2d7b62eda5838452efd0bed8f25f8a9cb9fe430c9ec39749181e24be93ed

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1815802853:AAFwTZ6mRU-UOmcTcCR8glZAAkNmzHpMkL8/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1564-109-0x000000000043773E-mapping.dmp	family_agenttesla
behavioral1/memory/1564-108-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1564-110-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

#$$$!1weF5(1).exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\service.exe = "C:\\Users\\Admin\\AppData\\Roaming\\service.exe\\service.exe.exe"	#$$$!1weF5(1).exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

#$$$!1weF5(1).exe

description pid process target process

PID 1964 set thread context of 1564 1964 #$$$!1weF5(1).exe #$$$!1weF5(1).exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

556 PING.EXE
1828 PING.EXE
1356 PING.EXE
436 PING.EXE

description	pid	process	target process
PID 1964 set thread context of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe

pid	process
556	PING.EXE
1828	PING.EXE
1356	PING.EXE
436	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe#$$$!1weF5(1).exe#$$$!1weF5(1).exe

pid	process
752	powershell.exe
752	powershell.exe
1968	powershell.exe
1968	powershell.exe
808	powershell.exe
808	powershell.exe
1504	powershell.exe
1504	powershell.exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1964	#$$$!1weF5(1).exe
1564	#$$$!1weF5(1).exe
1564	#$$$!1weF5(1).exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe#$$$!1weF5(1).exe#$$$!1weF5(1).exe

description	pid	process
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1964	#$$$!1weF5(1).exe
Token: SeDebugPrivilege	1564	#$$$!1weF5(1).exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

#$$$!1weF5(1).exe

pid process

1564 #$$$!1weF5(1).exe

pid	process
1564	#$$$!1weF5(1).exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

#$$$!1weF5(1).exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1964 wrote to memory of 752	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 752	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 752	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 752	1964	#$$$!1weF5(1).exe	powershell.exe
PID 752 wrote to memory of 556	752	powershell.exe	PING.EXE
PID 752 wrote to memory of 556	752	powershell.exe	PING.EXE
PID 752 wrote to memory of 556	752	powershell.exe	PING.EXE
PID 752 wrote to memory of 556	752	powershell.exe	PING.EXE
PID 1964 wrote to memory of 1968	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 1968	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 1968	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 1968	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1968 wrote to memory of 1828	1968	powershell.exe	PING.EXE
PID 1968 wrote to memory of 1828	1968	powershell.exe	PING.EXE
PID 1968 wrote to memory of 1828	1968	powershell.exe	PING.EXE
PID 1968 wrote to memory of 1828	1968	powershell.exe	PING.EXE
PID 1964 wrote to memory of 808	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 808	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 808	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 808	1964	#$$$!1weF5(1).exe	powershell.exe
PID 808 wrote to memory of 1356	808	powershell.exe	PING.EXE
PID 808 wrote to memory of 1356	808	powershell.exe	PING.EXE
PID 808 wrote to memory of 1356	808	powershell.exe	PING.EXE
PID 808 wrote to memory of 1356	808	powershell.exe	PING.EXE
PID 1964 wrote to memory of 1504	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 1504	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 1504	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1964 wrote to memory of 1504	1964	#$$$!1weF5(1).exe	powershell.exe
PID 1504 wrote to memory of 436	1504	powershell.exe	PING.EXE
PID 1504 wrote to memory of 436	1504	powershell.exe	PING.EXE
PID 1504 wrote to memory of 436	1504	powershell.exe	PING.EXE
PID 1504 wrote to memory of 436	1504	powershell.exe	PING.EXE
PID 1964 wrote to memory of 2004	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 2004	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 2004	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 2004	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 852	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 852	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 852	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 852	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1596	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1596	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1596	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1596	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe
PID 1964 wrote to memory of 1564	1964	#$$$!1weF5(1).exe	#$$$!1weF5(1).exe

C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
"C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" gooogle.com
3⤵
- Runs ping.exe
PID:556

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" gooogle.com
3⤵
- Runs ping.exe
PID:1828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" gooogle.com
3⤵
- Runs ping.exe
PID:1356

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" gooogle.com
3⤵
- Runs ping.exe
PID:436

C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
2⤵
PID:2004

C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
2⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
2⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
7680d3bc90f5ef3183490cf65397b63a

SHA1
2e2591c78e6b79bbe3f17a59c7ca62ab5fbd4b4c

SHA256
9db669b46ee1453688baa3305031e20ff3597e347a40afbd3f74e49f6ea87e0a

SHA512
1ef15402415e77c1db642217329743a782e281c1178e54710b7874533a0f0849835618c41b662d28a4aef40d3c8cc6f4df86c1ca23ca001654c5ea67e8162f1a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
7680d3bc90f5ef3183490cf65397b63a

SHA1
2e2591c78e6b79bbe3f17a59c7ca62ab5fbd4b4c

SHA256
9db669b46ee1453688baa3305031e20ff3597e347a40afbd3f74e49f6ea87e0a

SHA512
1ef15402415e77c1db642217329743a782e281c1178e54710b7874533a0f0849835618c41b662d28a4aef40d3c8cc6f4df86c1ca23ca001654c5ea67e8162f1a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
7680d3bc90f5ef3183490cf65397b63a

SHA1
2e2591c78e6b79bbe3f17a59c7ca62ab5fbd4b4c

SHA256
9db669b46ee1453688baa3305031e20ff3597e347a40afbd3f74e49f6ea87e0a

SHA512
1ef15402415e77c1db642217329743a782e281c1178e54710b7874533a0f0849835618c41b662d28a4aef40d3c8cc6f4df86c1ca23ca001654c5ea67e8162f1a

Download Submit
memory/436-100-0x0000000000000000-mapping.dmp

Download
memory/556-70-0x0000000000000000-mapping.dmp

Download
memory/752-63-0x0000000000000000-mapping.dmp

Download
memory/752-64-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download
memory/752-65-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/752-66-0x0000000002600000-0x000000000324A000-memory.dmp

Filesize
12.3MB

Download
memory/752-67-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/752-68-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/752-69-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/808-84-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/808-89-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/808-88-0x00000000049A2000-0x00000000049A3000-memory.dmp

Filesize
4KB

Download
memory/808-87-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/808-86-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/808-85-0x00000000049E0000-0x00000000049E1000-memory.dmp

Filesize
4KB

Download
memory/808-81-0x0000000000000000-mapping.dmp

Download
memory/1356-90-0x0000000000000000-mapping.dmp

Download
memory/1504-99-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/1504-97-0x0000000004932000-0x0000000004933000-memory.dmp

Filesize
4KB

Download
memory/1504-91-0x0000000000000000-mapping.dmp

Download
memory/1504-95-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/1504-96-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/1504-98-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1564-110-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-112-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/1564-113-0x0000000004981000-0x0000000004982000-memory.dmp

Filesize
4KB

Download
memory/1564-109-0x000000000043773E-mapping.dmp

Download
memory/1564-108-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1828-80-0x0000000000000000-mapping.dmp

Download
memory/1964-59-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1964-62-0x0000000004D65000-0x0000000004D76000-memory.dmp

Filesize
68KB

Download
memory/1964-61-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/1964-101-0x0000000005100000-0x0000000005155000-memory.dmp

Filesize
340KB

Download
memory/1964-106-0x0000000007E80000-0x0000000007EEB000-memory.dmp

Filesize
428KB

Download
memory/1964-107-0x0000000004D76000-0x0000000004D77000-memory.dmp

Filesize
4KB

Download
memory/1968-76-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/1968-71-0x0000000000000000-mapping.dmp

Download
memory/1968-79-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/1968-78-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/1968-77-0x00000000048F2000-0x00000000048F3000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads