agenttesla | 6e6c927afc8340a1a15150f50bd68ff6ec6964928b5e68ffc631a4e245894c6a

General

Target

New Order-040201.exe
Size

1.1MB
MD5

f0353c27594e08be39fbcf8c9e51eaf6
SHA1

ca1067bf97d677248def3252d027d87f545f1671
SHA256

6e6c927afc8340a1a15150f50bd68ff6ec6964928b5e68ffc631a4e245894c6a
SHA512

1526cc91823d20fd9591bb1b61f605bce13f21399c958b51b53132387b733bd691697b45eb3dc3b6dc7414318d9214a3c38da2e12c3d20ee6131130c7ffa4e97

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
chamara.kuruppu@organigram-ca.icu
Password:
Neways@123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3776-127-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3776-128-0x000000000043747E-mapping.dmp	family_agenttesla
behavioral2/memory/3776-134-0x0000000005610000-0x0000000005B0E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

New Order-040201.exe

description pid process target process

PID 3692 set thread context of 3776 3692 New Order-040201.exe New Order-040201.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3988 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

New Order-040201.exeNew Order-040201.exe

pid process

3692 New Order-040201.exe
3776 New Order-040201.exe
3776 New Order-040201.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

New Order-040201.exeNew Order-040201.exe

description pid process

Token: SeDebugPrivilege 3692 New Order-040201.exe
Token: SeDebugPrivilege 3776 New Order-040201.exe

description	pid	process	target process
PID 3692 set thread context of 3776	3692	New Order-040201.exe	New Order-040201.exe

pid	process
3988	schtasks.exe

pid	process
3692	New Order-040201.exe
3776	New Order-040201.exe
3776	New Order-040201.exe

description	pid	process
Token: SeDebugPrivilege	3692	New Order-040201.exe
Token: SeDebugPrivilege	3776	New Order-040201.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

New Order-040201.exe

description	pid	process	target process
PID 3692 wrote to memory of 3988	3692	New Order-040201.exe	schtasks.exe
PID 3692 wrote to memory of 3988	3692	New Order-040201.exe	schtasks.exe
PID 3692 wrote to memory of 3988	3692	New Order-040201.exe	schtasks.exe
PID 3692 wrote to memory of 3776	3692	New Order-040201.exe	New Order-040201.exe
PID 3692 wrote to memory of 3776	3692	New Order-040201.exe	New Order-040201.exe
PID 3692 wrote to memory of 3776	3692	New Order-040201.exe	New Order-040201.exe
PID 3692 wrote to memory of 3776	3692	New Order-040201.exe	New Order-040201.exe
PID 3692 wrote to memory of 3776	3692	New Order-040201.exe	New Order-040201.exe
PID 3692 wrote to memory of 3776	3692	New Order-040201.exe	New Order-040201.exe
PID 3692 wrote to memory of 3776	3692	New Order-040201.exe	New Order-040201.exe
PID 3692 wrote to memory of 3776	3692	New Order-040201.exe	New Order-040201.exe

C:\Users\Admin\AppData\Local\Temp\New Order-040201.exe
"C:\Users\Admin\AppData\Local\Temp\New Order-040201.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RVRnWlSQF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp802D.tmp"
2⤵
- Creates scheduled task(s)
PID:3988

C:\Users\Admin\AppData\Local\Temp\New Order-040201.exe
"C:\Users\Admin\AppData\Local\Temp\New Order-040201.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Order-040201.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp802D.tmp
MD5
125f0e319f7ef12234006537be472c5b

SHA1
4946847dda18f9b20b4311e222452421d65226d0

SHA256
9fd3c01b9065c8f16b42716d158db040fe00f949e131d7fb27785b846e37b06e

SHA512
b4c47a351e766bf95e3d74735e0f87b3e0390869041a645a0602bfe20cb5660012aa123f7de5043035a85fb234e628d8dfb6d20a3381ece2e0a161b2a35ded55

Download Submit
memory/3692-123-0x0000000004E80000-0x0000000004EFD000-memory.dmp

Filesize
500KB

Download
memory/3692-124-0x0000000004F60000-0x0000000004F99000-memory.dmp

Filesize
228KB

Download
memory/3692-119-0x0000000007040000-0x0000000007041000-memory.dmp

Filesize
4KB

Download
memory/3692-120-0x0000000007230000-0x0000000007231000-memory.dmp

Filesize
4KB

Download
memory/3692-121-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/3692-122-0x0000000004520000-0x000000000453B000-memory.dmp

Filesize
108KB

Download
memory/3692-114-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/3692-118-0x00000000070D0000-0x00000000070D1000-memory.dmp

Filesize
4KB

Download
memory/3692-116-0x0000000006F90000-0x0000000006F91000-memory.dmp

Filesize
4KB

Download
memory/3692-117-0x0000000007530000-0x0000000007531000-memory.dmp

Filesize
4KB

Download
memory/3776-127-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3776-128-0x000000000043747E-mapping.dmp

Download
memory/3776-134-0x0000000005610000-0x0000000005B0E000-memory.dmp

Filesize
5.0MB

Download
memory/3776-135-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/3776-136-0x0000000006100000-0x0000000006101000-memory.dmp

Filesize
4KB

Download
memory/3988-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads