agenttesla | aac191cc316509f0ace5358a185e43a8d221c2f8374760ee8fdbbca632674bd2

General

Target

ACCOUNT FORM.exe
Size

1.7MB
MD5

bb06da848bdf0fb902bc05bfaa2deca3
SHA1

efd66a569fb1ea9cbba3c1160cb8a6975560e779
SHA256

123de48e610d4e6dacfb9722ccf5073154cd419537a7b60aa510d81e06e51404
SHA512

0f820c5e48eadc224cafc3d8d32df853b8041f69f378aa42d5c3f417e152f9af8807dfd0d57813cec75f54d9621edf11fc51c048bf32cbfcf634d93b5ca349a9

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.ozkengumruk.com.tr
Port:
587
Username:
[email protected]
Password:
A!wak487

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/680-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/680-63-0x00000000004376CE-mapping.dmp	family_agenttesla
behavioral1/memory/680-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\tKZVPq = "C:\\Users\\Admin\\AppData\\Roaming\\tKZVPq\\tKZVPq.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ACCOUNT FORM.exe

description pid process target process

PID 1380 set thread context of 680 1380 ACCOUNT FORM.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

748 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ACCOUNT FORM.exeRegSvcs.exe

pid process

1380 ACCOUNT FORM.exe
1380 ACCOUNT FORM.exe
1380 ACCOUNT FORM.exe
680 RegSvcs.exe
680 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ACCOUNT FORM.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1380 ACCOUNT FORM.exe
Token: SeDebugPrivilege 680 RegSvcs.exe

description	pid	process	target process
PID 1380 set thread context of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe

pid	process
748	schtasks.exe

pid	process
1380	ACCOUNT FORM.exe
1380	ACCOUNT FORM.exe
1380	ACCOUNT FORM.exe
680	RegSvcs.exe
680	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1380	ACCOUNT FORM.exe
Token: SeDebugPrivilege	680	RegSvcs.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

ACCOUNT FORM.exe

description	pid	process	target process
PID 1380 wrote to memory of 748	1380	ACCOUNT FORM.exe	schtasks.exe
PID 1380 wrote to memory of 748	1380	ACCOUNT FORM.exe	schtasks.exe
PID 1380 wrote to memory of 748	1380	ACCOUNT FORM.exe	schtasks.exe
PID 1380 wrote to memory of 748	1380	ACCOUNT FORM.exe	schtasks.exe
PID 1380 wrote to memory of 860	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 860	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 860	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 860	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 860	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 860	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 860	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 840	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 840	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 840	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 840	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 840	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 840	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 840	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 524	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 524	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 524	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 524	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 524	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 524	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 524	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe
PID 1380 wrote to memory of 680	1380	ACCOUNT FORM.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\ACCOUNT FORM.exe
"C:\Users\Admin\AppData\Local\Temp\ACCOUNT FORM.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qykCLxbojSJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64DA.tmp"
2⤵
- Creates scheduled task(s)
PID:748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp64DA.tmp
MD5
fd0ac2aa5c7d2a9d694e4d487e0bf143

SHA1
da788c7e64eb1dfaeb77a13ea15bfa3c2d05c040

SHA256
13f4272b1f988b8e12f6bf4032dd3ac94da52d39c7fbc80db6b84c4764dba4fa

SHA512
4259f97e89c78c7e6dfb2a14ae25ea1d840af61c754ab7cf92d3ce9fa791f7a2f8e13285c4d3e0da034849e0d76fdd0a9514b1cf7c265b41d18f77b181103099

Download Submit
memory/680-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/680-63-0x00000000004376CE-mapping.dmp

Download
memory/680-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/680-66-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/680-67-0x0000000004911000-0x0000000004912000-memory.dmp

Filesize
4KB

Download
memory/748-60-0x0000000000000000-mapping.dmp

Download
memory/1380-54-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1380-56-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/1380-57-0x0000000000640000-0x000000000064E000-memory.dmp

Filesize
56KB

Download
memory/1380-58-0x0000000004FC0000-0x000000000503B000-memory.dmp

Filesize
492KB

Download
memory/1380-59-0x0000000004B20000-0x0000000004B58000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads