agenttesla | 2307054debb98d7c9ca5b5fbce5ca1210c49563dbe01d2fa28cc24099a2db022

General

Target

Images.exe
Size

973KB
MD5

82489381d072392f3075161bbb1ec8b8
SHA1

5ac44b1ad6d31f14e22013792aed5033af1bed97
SHA256

2307054debb98d7c9ca5b5fbce5ca1210c49563dbe01d2fa28cc24099a2db022
SHA512

e53d7c446b87211327033139b6d0b539ed7aa0d2db660eaa44ad3d96499a03a26e96a887c47250c7ee685ae7a7bd3cc71aa49097c10ba6371f928a2cdf2c402d

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.nuntai-tw.com
Port:
587
Username:
greta@nuntai-tw.com
Password:
tanga333

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3144-127-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3144-128-0x0000000000436CFE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Images.exe

description pid process target process

PID 3716 set thread context of 3144 3716 Images.exe Images.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2564 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Images.exeImages.exe

pid process

3716 Images.exe
3716 Images.exe
3144 Images.exe
3144 Images.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Images.exeImages.exe

description pid process

Token: SeDebugPrivilege 3716 Images.exe
Token: SeDebugPrivilege 3144 Images.exe

description	pid	process	target process
PID 3716 set thread context of 3144	3716	Images.exe	Images.exe

pid	process
2564	schtasks.exe

pid	process
3716	Images.exe
3716	Images.exe
3144	Images.exe
3144	Images.exe

description	pid	process
Token: SeDebugPrivilege	3716	Images.exe
Token: SeDebugPrivilege	3144	Images.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Images.exe

description	pid	process	target process
PID 3716 wrote to memory of 2564	3716	Images.exe	schtasks.exe
PID 3716 wrote to memory of 2564	3716	Images.exe	schtasks.exe
PID 3716 wrote to memory of 2564	3716	Images.exe	schtasks.exe
PID 3716 wrote to memory of 2096	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 2096	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 2096	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 3144	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 3144	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 3144	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 3144	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 3144	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 3144	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 3144	3716	Images.exe	Images.exe
PID 3716 wrote to memory of 3144	3716	Images.exe	Images.exe

C:\Users\Admin\AppData\Local\Temp\Images.exe
"C:\Users\Admin\AppData\Local\Temp\Images.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\THigGvOw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCC9.tmp"
2⤵
- Creates scheduled task(s)
PID:2564

C:\Users\Admin\AppData\Local\Temp\Images.exe
"C:\Users\Admin\AppData\Local\Temp\Images.exe"
2⤵
PID:2096

C:\Users\Admin\AppData\Local\Temp\Images.exe
"C:\Users\Admin\AppData\Local\Temp\Images.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Images.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBCC9.tmp
MD5
928937800c5865c889097ff2cc6726a1

SHA1
cb2275803beab12582f48eff11c7793105790f8a

SHA256
6cbcca0624f94eac60ff424f43a4feb3947db727d9b83131cf64bc3ce8d50b10

SHA512
5b0c07f2f41a96a4925070925a5b8e576e7f6d8d80bb5bf8d18b23862acb17683f6f355637deec5c716ce0a67e763bbf583754348d3385b0bd5d004424b200b5

Download Submit
memory/2564-125-0x0000000000000000-mapping.dmp

Download
memory/3144-136-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download
memory/3144-135-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/3144-134-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/3144-128-0x0000000000436CFE-mapping.dmp

Download
memory/3144-127-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3716-119-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3716-124-0x0000000004F20000-0x0000000004F5B000-memory.dmp

Filesize
236KB

Download
memory/3716-123-0x0000000005430000-0x00000000054A5000-memory.dmp

Filesize
468KB

Download
memory/3716-122-0x0000000005170000-0x000000000519D000-memory.dmp

Filesize
180KB

Download
memory/3716-121-0x0000000005010000-0x000000000550E000-memory.dmp

Filesize
5.0MB

Download
memory/3716-120-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/3716-114-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/3716-118-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/3716-117-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/3716-116-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads