agenttesla | d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26

General

Target

d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
Size

532KB
MD5

54d4818b7b9b23930120c8673c706d13
SHA1

c36c7ecd843f2f46c2157d0d1e82bb90cc329dfa
SHA256

d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26
SHA512

e2c1de8b3f364f50e9ef37bce339bad66c68c2b7de5e42c57e80d7e842160e22c783b9da362ccf6b1d47b0c121b0c20142e2f68ea462f9bfd0cb310f7d4f1295

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2011876152:AAE2-KS2icrnTIfs2BShfFL-azbHdJ_0afc/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1060-126-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1060-127-0x00000000004378AE-mapping.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\winfiles = "C:\\Users\\Admin\\AppData\\Roaming\\winfiles\\winfiles.exe"	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe

description	pid	process	target process
PID 2068 set thread context of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exed8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exepowershell.exe

pid	process
2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
1060	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
1060	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
840	powershell.exe
840	powershell.exe
840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exed8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
Token: SeDebugPrivilege	1060	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
Token: SeDebugPrivilege	840	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe

description	pid	process	target process
PID 2068 wrote to memory of 840	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	powershell.exe
PID 2068 wrote to memory of 840	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	powershell.exe
PID 2068 wrote to memory of 840	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	powershell.exe
PID 2068 wrote to memory of 792	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 792	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 792	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
PID 2068 wrote to memory of 1060	2068	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe	d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe

C:\Users\Admin\AppData\Local\Temp\d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
"C:\Users\Admin\AppData\Local\Temp\d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Users\Admin\AppData\Local\Temp\d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
  "C:\Users\Admin\AppData\Local\Temp\d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe"
  2⤵
  PID:792
- C:\Users\Admin\AppData\Local\Temp\d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe
  "C:\Users\Admin\AppData\Local\Temp\d8df180f1f880ef3d7d0066d76d717bec1bfb74073765895c4192895abc57d26.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-153-0x0000000008AF0000-0x0000000008B23000-memory.dmp

Filesize
204KB

Download
memory/840-155-0x000000007EA60000-0x000000007EA61000-memory.dmp

Filesize
4KB

Download
memory/840-367-0x0000000008F50000-0x0000000008F51000-memory.dmp

Filesize
4KB

Download
memory/840-138-0x00000000073B0000-0x00000000073B1000-memory.dmp

Filesize
4KB

Download
memory/840-361-0x0000000008F60000-0x0000000008F61000-memory.dmp

Filesize
4KB

Download
memory/840-236-0x0000000004313000-0x0000000004314000-memory.dmp

Filesize
4KB

Download
memory/840-167-0x0000000008FC0000-0x0000000008FC1000-memory.dmp

Filesize
4KB

Download
memory/840-139-0x0000000007600000-0x0000000007601000-memory.dmp

Filesize
4KB

Download
memory/840-166-0x0000000008E20000-0x0000000008E21000-memory.dmp

Filesize
4KB

Download
memory/840-125-0x0000000000000000-mapping.dmp

Download
memory/840-161-0x0000000008AB0000-0x0000000008AB1000-memory.dmp

Filesize
4KB

Download
memory/840-145-0x0000000007CA0000-0x0000000007CA1000-memory.dmp

Filesize
4KB

Download
memory/840-133-0x00000000041F0000-0x00000000041F1000-memory.dmp

Filesize
4KB

Download
memory/840-140-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/840-136-0x0000000006A40000-0x0000000006A41000-memory.dmp

Filesize
4KB

Download
memory/840-137-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

Filesize
4KB

Download
memory/840-144-0x0000000007A10000-0x0000000007A11000-memory.dmp

Filesize
4KB

Download
memory/840-143-0x0000000007480000-0x0000000007481000-memory.dmp

Filesize
4KB

Download
memory/840-135-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/840-142-0x0000000004312000-0x0000000004313000-memory.dmp

Filesize
4KB

Download
memory/1060-141-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1060-382-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/1060-126-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1060-127-0x00000000004378AE-mapping.dmp

Download
memory/2068-117-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/2068-115-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/2068-119-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/2068-121-0x0000000002B80000-0x0000000002B87000-memory.dmp

Filesize
28KB

Download
memory/2068-122-0x0000000005130000-0x000000000562E000-memory.dmp

Filesize
5.0MB

Download
memory/2068-124-0x0000000005F40000-0x0000000005F81000-memory.dmp

Filesize
260KB

Download
memory/2068-120-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/2068-118-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/2068-123-0x0000000005ED0000-0x0000000005F3C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads