agenttesla | 2f25825c264a731f59bdee108cdd8fdf062501404952294c7fdbd4e46d4ccc7e

General

Target

attached TT PDF.exe
Size

789KB
MD5

891f97173c0a90ed3d336e303908b38a
SHA1

49a4e10a12d5aec836cc2b1cfcfce3784446929b
SHA256

2f25825c264a731f59bdee108cdd8fdf062501404952294c7fdbd4e46d4ccc7e
SHA512

b5c3168d1ded6eeee2b364f9d0aa3e45f60c630d353d6d1178f84e784783def83ed9512069fdb04821150cb04344f0b2e17088033ecddb15709615bca947eed3

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.esquiresweaters.com
Port:
587
Username:
imam@esquiresweaters.com
Password:
Esquire@#2078

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1112-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1112-70-0x000000000043766E-mapping.dmp	family_agenttesla
behavioral1/memory/1112-71-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

attached TT PDF.exe

description pid process target process

PID 2004 set thread context of 1112 2004 attached TT PDF.exe attached TT PDF.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1388 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

attached TT PDF.exe

pid process

1112 attached TT PDF.exe
1112 attached TT PDF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

attached TT PDF.exe

description pid process

Token: SeDebugPrivilege 1112 attached TT PDF.exe

description	pid	process	target process
PID 2004 set thread context of 1112	2004	attached TT PDF.exe	attached TT PDF.exe

pid	process
1388	schtasks.exe

pid	process
1112	attached TT PDF.exe
1112	attached TT PDF.exe

description	pid	process
Token: SeDebugPrivilege	1112	attached TT PDF.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

attached TT PDF.exe

description	pid	process	target process
PID 2004 wrote to memory of 1388	2004	attached TT PDF.exe	schtasks.exe
PID 2004 wrote to memory of 1388	2004	attached TT PDF.exe	schtasks.exe
PID 2004 wrote to memory of 1388	2004	attached TT PDF.exe	schtasks.exe
PID 2004 wrote to memory of 1388	2004	attached TT PDF.exe	schtasks.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe
PID 2004 wrote to memory of 1112	2004	attached TT PDF.exe	attached TT PDF.exe

C:\Users\Admin\AppData\Local\Temp\attached TT PDF.exe
"C:\Users\Admin\AppData\Local\Temp\attached TT PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VzKaRFUJOv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF392.tmp"
2⤵
- Creates scheduled task(s)
PID:1388

C:\Users\Admin\AppData\Local\Temp\attached TT PDF.exe
"C:\Users\Admin\AppData\Local\Temp\attached TT PDF.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF392.tmp
MD5
7cd71f127387467ade05da833cd78950

SHA1
f3cad96de7c396d8bdfdccf710239243f5462ea0

SHA256
7fc96abcd8210ac9964a465da1a1a5338ee8eccd13c356ecb8303b29301859a2

SHA512
10da59b1de0eb6fc7eac678e6cbb8992c73759b8f2f14ffb1ac37894165d5a79387e6e50e244469b2ec227660e5d05cc7a6bfbd74d58cdd9ca74d2ee964fb02d

Download Submit
memory/1112-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1112-70-0x000000000043766E-mapping.dmp

Download
memory/1112-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1112-73-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1388-67-0x0000000000000000-mapping.dmp

Download
memory/2004-60-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2004-62-0x0000000002100000-0x00000000021BB000-memory.dmp

Filesize
748KB

Download
memory/2004-63-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/2004-64-0x0000000000240000-0x000000000025B000-memory.dmp

Filesize
108KB

Download
memory/2004-65-0x0000000004B50000-0x0000000004BD3000-memory.dmp

Filesize
524KB

Download
memory/2004-66-0x0000000000790000-0x00000000007CE000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads