agenttesla | cd043324499b97f0bfcd00d02c0a094aa6d8f4b33f5cd80d94ebf92445f8dc02

General

Target

fa322b962d854050adb6c6546f7aaed5.exe
Size

684KB
MD5

fa322b962d854050adb6c6546f7aaed5
SHA1

b1c7f9e0cf2d4c99175bc38fb4d12d34858e5bea
SHA256

cd043324499b97f0bfcd00d02c0a094aa6d8f4b33f5cd80d94ebf92445f8dc02
SHA512

0a128ee744ed52a9a58ea2136b09e18b90f856a19ee4608ac995a49ecee807c7ff3f8a8f2bd0d313d79e43e7cf4ea14aa33f4e2bcfd540e8bd28043633ff4b9d

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
dutchgardenfoodservices@saleperson.icu
Password:
GOODGOD1234

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1152-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1152-68-0x00000000004374AE-mapping.dmp	family_agenttesla
behavioral1/memory/1152-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/640-62-0x0000000000300000-0x000000000030B000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

Processes:

fa322b962d854050adb6c6546f7aaed5.exe

description pid process target process

PID 640 set thread context of 1152 640 fa322b962d854050adb6c6546f7aaed5.exe fa322b962d854050adb6c6546f7aaed5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

268 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fa322b962d854050adb6c6546f7aaed5.exe

pid process

1152 fa322b962d854050adb6c6546f7aaed5.exe
1152 fa322b962d854050adb6c6546f7aaed5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fa322b962d854050adb6c6546f7aaed5.exe

description pid process

Token: SeDebugPrivilege 1152 fa322b962d854050adb6c6546f7aaed5.exe

description	pid	process	target process
PID 640 set thread context of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe

pid	process
268	schtasks.exe

pid	process
1152	fa322b962d854050adb6c6546f7aaed5.exe
1152	fa322b962d854050adb6c6546f7aaed5.exe

description	pid	process
Token: SeDebugPrivilege	1152	fa322b962d854050adb6c6546f7aaed5.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fa322b962d854050adb6c6546f7aaed5.exe

description	pid	process	target process
PID 640 wrote to memory of 268	640	fa322b962d854050adb6c6546f7aaed5.exe	schtasks.exe
PID 640 wrote to memory of 268	640	fa322b962d854050adb6c6546f7aaed5.exe	schtasks.exe
PID 640 wrote to memory of 268	640	fa322b962d854050adb6c6546f7aaed5.exe	schtasks.exe
PID 640 wrote to memory of 268	640	fa322b962d854050adb6c6546f7aaed5.exe	schtasks.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe
PID 640 wrote to memory of 1152	640	fa322b962d854050adb6c6546f7aaed5.exe	fa322b962d854050adb6c6546f7aaed5.exe

C:\Users\Admin\AppData\Local\Temp\fa322b962d854050adb6c6546f7aaed5.exe
"C:\Users\Admin\AppData\Local\Temp\fa322b962d854050adb6c6546f7aaed5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OCdOwh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC764.tmp"
2⤵
- Creates scheduled task(s)
PID:268

C:\Users\Admin\AppData\Local\Temp\fa322b962d854050adb6c6546f7aaed5.exe
"C:\Users\Admin\AppData\Local\Temp\fa322b962d854050adb6c6546f7aaed5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC764.tmp
MD5
4d6f802e55e98c6d692a2f87a0f18ef4

SHA1
431d288d17bada7a65cd807069cd6150b875e467

SHA256
1af926c31fb5b70218fee113d63b0dfaec02fe6d1742a9937f384277079d9e29

SHA512
10bede6d6bd8f8abd681d35c71f9a031304125a6183c7ace703ad7db62088f0570ca6d3d8f9fedf798f08e15401b636c25b8913ba6e71474db612974986ea003

Download Submit
memory/268-65-0x0000000000000000-mapping.dmp

Download
memory/640-59-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/640-61-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/640-62-0x0000000000300000-0x000000000030B000-memory.dmp

Filesize
44KB

Download
memory/640-63-0x0000000004410000-0x0000000004492000-memory.dmp

Filesize
520KB

Download
memory/640-64-0x0000000000B60000-0x0000000000B9D000-memory.dmp

Filesize
244KB

Download
memory/1152-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1152-68-0x00000000004374AE-mapping.dmp

Download
memory/1152-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1152-71-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads