agenttesla | a6229790b0a76fded9219434078e2ba9349cd636ee4fa6c633d0779a464c07f7

General

Target

ENQUIRY.exe
Size

570KB
MD5

dfc7cff14929dc6879d88a2c514bfef8
SHA1

319f1833848a98c976c1eb074af16a52ee4d1433
SHA256

a6229790b0a76fded9219434078e2ba9349cd636ee4fa6c633d0779a464c07f7
SHA512

452237738c52331f7dce3d5d6da93464a7be47c4ffe1d782958c562beed0021717465fda0db9115392a4766f2b8f7ef0ccd89645e2b7d8b4fe75ac3ccb70d85b

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.aldhiyafainteriors.com
Port:
587
Username:
rahman@aldhiyafainteriors.com
Password:
dhiyafa@987

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/516-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/516-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/516-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/516-64-0x00000000004376CE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

ENQUIRY.exe

description pid process target process

PID 332 set thread context of 516 332 ENQUIRY.exe ENQUIRY.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

636 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ENQUIRY.exe

pid process

332 ENQUIRY.exe
332 ENQUIRY.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1120 dw20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ENQUIRY.exe

description pid process

Token: SeDebugPrivilege 332 ENQUIRY.exe

description	pid	process	target process
PID 332 set thread context of 516	332	ENQUIRY.exe	ENQUIRY.exe

pid	process
636	schtasks.exe

pid	process
332	ENQUIRY.exe
332	ENQUIRY.exe

pid	process
1120	dw20.exe

description	pid	process
Token: SeDebugPrivilege	332	ENQUIRY.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

ENQUIRY.exeENQUIRY.exe

description	pid	process	target process
PID 332 wrote to memory of 636	332	ENQUIRY.exe	schtasks.exe
PID 332 wrote to memory of 636	332	ENQUIRY.exe	schtasks.exe
PID 332 wrote to memory of 636	332	ENQUIRY.exe	schtasks.exe
PID 332 wrote to memory of 636	332	ENQUIRY.exe	schtasks.exe
PID 332 wrote to memory of 272	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 272	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 272	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 272	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 332 wrote to memory of 516	332	ENQUIRY.exe	ENQUIRY.exe
PID 516 wrote to memory of 1120	516	ENQUIRY.exe	dw20.exe
PID 516 wrote to memory of 1120	516	ENQUIRY.exe	dw20.exe
PID 516 wrote to memory of 1120	516	ENQUIRY.exe	dw20.exe
PID 516 wrote to memory of 1120	516	ENQUIRY.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\ENQUIRY.exe
"C:\Users\Admin\AppData\Local\Temp\ENQUIRY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qhikTxSZJsELY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7935.tmp"
2⤵
- Creates scheduled task(s)
PID:636

C:\Users\Admin\AppData\Local\Temp\ENQUIRY.exe
"{path}"
2⤵
PID:272

C:\Users\Admin\AppData\Local\Temp\ENQUIRY.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 392
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1120

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7935.tmp
MD5
d8a25d9ba075181dd043afbaab152133

SHA1
fa8aff902d3e3ad2945f0dbace140dd82953083f

SHA256
673c6fb9405c0844296bfcc9f1b80582c536d1b7b5fc801f701697f5e3346a62

SHA512
86d6309ff213ab43e35853d68f07bb66a10afa10d7c304285962201a80d71c125dc48eca9c5604b6d7e854c40c614352a1c597af0a6528b364ce7243ac532ea7

Download Submit
memory/332-55-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/332-56-0x0000000000111000-0x0000000000112000-memory.dmp

Filesize
4KB

Download
memory/332-54-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/516-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/516-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/516-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/516-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/516-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/516-64-0x00000000004376CE-mapping.dmp

Download
memory/516-68-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/636-57-0x0000000000000000-mapping.dmp

Download
memory/1120-66-0x0000000000000000-mapping.dmp

Download
memory/1120-69-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads